ecp_curves.c 51.2 KB
Newer Older
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
1 2 3
/*
 *  Elliptic curves over GF(p): curve-specific data and functions
 *
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
4
 *  Copyright (C) 2006-2014, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
5
 *
6
 *  This file is part of mbed TLS (https://www.polarssl.org)
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License along
 *  with this program; if not, write to the Free Software Foundation, Inc.,
 *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

23
#if !defined(POLARSSL_CONFIG_FILE)
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
24
#include "polarssl/config.h"
25 26 27
#else
#include POLARSSL_CONFIG_FILE
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
28 29 30 31 32

#if defined(POLARSSL_ECP_C)

#include "polarssl/ecp.h"

33 34 35 36 37 38 39 40
#if defined(_MSC_VER) && !defined(inline)
#define inline _inline
#else
#if defined(__ARMCC_VERSION) && !defined(inline)
#define inline __inline
#endif /* __ARMCC_VERSION */
#endif /*_MSC_VER */

41 42
/*
 * Conversion macros for embedded constants:
43
 * build lists of t_uint's from lists of unsigned char's grouped by 8, 4 or 2
44
 */
45 46
#if defined(POLARSSL_HAVE_INT8)

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
47
#define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
48 49
    a, b, c, d, e, f, g, h

50 51 52 53 54 55
#define BYTES_TO_T_UINT_4( a, b, c, d )             \
    a, b, c, d

#define BYTES_TO_T_UINT_2( a, b )                   \
    a, b

56 57
#elif defined(POLARSSL_HAVE_INT16)

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
58 59
#define BYTES_TO_T_UINT_2( a, b )                   \
    ( (t_uint) a << 0 ) |                           \
60
    ( (t_uint) b << 8 )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
61

62 63 64 65
#define BYTES_TO_T_UINT_4( a, b, c, d )             \
    BYTES_TO_T_UINT_2( a, b ),                      \
    BYTES_TO_T_UINT_2( c, d )

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
66 67 68 69 70
#define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
    BYTES_TO_T_UINT_2( a, b ),                      \
    BYTES_TO_T_UINT_2( c, d ),                      \
    BYTES_TO_T_UINT_2( e, f ),                      \
    BYTES_TO_T_UINT_2( g, h )
71 72 73

#elif defined(POLARSSL_HAVE_INT32)

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
74 75 76 77
#define BYTES_TO_T_UINT_4( a, b, c, d )             \
    ( (t_uint) a <<  0 ) |                          \
    ( (t_uint) b <<  8 ) |                          \
    ( (t_uint) c << 16 ) |                          \
78
    ( (t_uint) d << 24 )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
79

80 81 82
#define BYTES_TO_T_UINT_2( a, b )                   \
    BYTES_TO_T_UINT_4( a, b, 0, 0 )

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
83
#define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
84
    BYTES_TO_T_UINT_4( a, b, c, d ),                \
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
85
    BYTES_TO_T_UINT_4( e, f, g, h )
86 87 88

#else /* 64-bits */

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
89
#define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
90 91 92 93 94 95 96 97 98
    ( (t_uint) a <<  0 ) |                          \
    ( (t_uint) b <<  8 ) |                          \
    ( (t_uint) c << 16 ) |                          \
    ( (t_uint) d << 24 ) |                          \
    ( (t_uint) e << 32 ) |                          \
    ( (t_uint) f << 40 ) |                          \
    ( (t_uint) g << 48 ) |                          \
    ( (t_uint) h << 56 )

99 100 101 102 103 104
#define BYTES_TO_T_UINT_4( a, b, c, d )             \
    BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 )

#define BYTES_TO_T_UINT_2( a, b )                   \
    BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 )

105 106
#endif /* bits in t_uint */

107 108 109 110 111
/*
 * Note: the constants are in little-endian order
 * to be directly usable in MPIs
 */

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
112 113 114
/*
 * Domain parameters for secp192r1
 */
115
#if defined(POLARSSL_ECP_DP_SECP192R1_ENABLED)
116
static const t_uint secp192r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
117 118 119
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
120
};
121
static const t_uint secp192r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
122 123 124
    BYTES_TO_T_UINT_8( 0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE ),
    BYTES_TO_T_UINT_8( 0x49, 0x30, 0x24, 0x72, 0xAB, 0xE9, 0xA7, 0x0F ),
    BYTES_TO_T_UINT_8( 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64 ),
125
};
126
static const t_uint secp192r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
127 128 129
    BYTES_TO_T_UINT_8( 0x12, 0x10, 0xFF, 0x82, 0xFD, 0x0A, 0xFF, 0xF4 ),
    BYTES_TO_T_UINT_8( 0x00, 0x88, 0xA1, 0x43, 0xEB, 0x20, 0xBF, 0x7C ),
    BYTES_TO_T_UINT_8( 0xF6, 0x90, 0x30, 0xB0, 0x0E, 0xA8, 0x8D, 0x18 ),
130
};
131
static const t_uint secp192r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
132 133 134
    BYTES_TO_T_UINT_8( 0x11, 0x48, 0x79, 0x1E, 0xA1, 0x77, 0xF9, 0x73 ),
    BYTES_TO_T_UINT_8( 0xD5, 0xCD, 0x24, 0x6B, 0xED, 0x11, 0x10, 0x63 ),
    BYTES_TO_T_UINT_8( 0x78, 0xDA, 0xC8, 0xFF, 0x95, 0x2B, 0x19, 0x07 ),
135
};
136
static const t_uint secp192r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
137 138 139
    BYTES_TO_T_UINT_8( 0x31, 0x28, 0xD2, 0xB4, 0xB1, 0xC9, 0x6B, 0x14 ),
    BYTES_TO_T_UINT_8( 0x36, 0xF8, 0xDE, 0x99, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
140
};
141
#endif /* POLARSSL_ECP_DP_SECP192R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
142 143 144 145

/*
 * Domain parameters for secp224r1
 */
146
#if defined(POLARSSL_ECP_DP_SECP224R1_ENABLED)
147
static const t_uint secp224r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
148 149 150 151
    BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
    BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
152
};
153
static const t_uint secp224r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
154 155 156
    BYTES_TO_T_UINT_8( 0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27 ),
    BYTES_TO_T_UINT_8( 0xBA, 0xD8, 0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50 ),
    BYTES_TO_T_UINT_8( 0x56, 0x32, 0x41, 0xF5, 0xAB, 0xB3, 0x04, 0x0C ),
157
    BYTES_TO_T_UINT_4( 0x85, 0x0A, 0x05, 0xB4 ),
158
};
159
static const t_uint secp224r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
160 161 162
    BYTES_TO_T_UINT_8( 0x21, 0x1D, 0x5C, 0x11, 0xD6, 0x80, 0x32, 0x34 ),
    BYTES_TO_T_UINT_8( 0x22, 0x11, 0xC2, 0x56, 0xD3, 0xC1, 0x03, 0x4A ),
    BYTES_TO_T_UINT_8( 0xB9, 0x90, 0x13, 0x32, 0x7F, 0xBF, 0xB4, 0x6B ),
163
    BYTES_TO_T_UINT_4( 0xBD, 0x0C, 0x0E, 0xB7 ),
164
};
165
static const t_uint secp224r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
166 167 168
    BYTES_TO_T_UINT_8( 0x34, 0x7E, 0x00, 0x85, 0x99, 0x81, 0xD5, 0x44 ),
    BYTES_TO_T_UINT_8( 0x64, 0x47, 0x07, 0x5A, 0xA0, 0x75, 0x43, 0xCD ),
    BYTES_TO_T_UINT_8( 0xE6, 0xDF, 0x22, 0x4C, 0xFB, 0x23, 0xF7, 0xB5 ),
169
    BYTES_TO_T_UINT_4( 0x88, 0x63, 0x37, 0xBD ),
170
};
171
static const t_uint secp224r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
172 173 174
    BYTES_TO_T_UINT_8( 0x3D, 0x2A, 0x5C, 0x5C, 0x45, 0x29, 0xDD, 0x13 ),
    BYTES_TO_T_UINT_8( 0x3E, 0xF0, 0xB8, 0xE0, 0xA2, 0x16, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
175
    BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
176
};
177
#endif /* POLARSSL_ECP_DP_SECP224R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
178 179 180 181

/*
 * Domain parameters for secp256r1
 */
182
#if defined(POLARSSL_ECP_DP_SECP256R1_ENABLED)
183
static const t_uint secp256r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
184 185 186 187
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
    BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
    BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
188
};
189
static const t_uint secp256r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
190 191 192 193
    BYTES_TO_T_UINT_8( 0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B ),
    BYTES_TO_T_UINT_8( 0xF6, 0xB0, 0x53, 0xCC, 0xB0, 0x06, 0x1D, 0x65 ),
    BYTES_TO_T_UINT_8( 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD, 0xEB, 0xB3 ),
    BYTES_TO_T_UINT_8( 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A ),
194
};
195
static const t_uint secp256r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
196 197 198 199
    BYTES_TO_T_UINT_8( 0x96, 0xC2, 0x98, 0xD8, 0x45, 0x39, 0xA1, 0xF4 ),
    BYTES_TO_T_UINT_8( 0xA0, 0x33, 0xEB, 0x2D, 0x81, 0x7D, 0x03, 0x77 ),
    BYTES_TO_T_UINT_8( 0xF2, 0x40, 0xA4, 0x63, 0xE5, 0xE6, 0xBC, 0xF8 ),
    BYTES_TO_T_UINT_8( 0x47, 0x42, 0x2C, 0xE1, 0xF2, 0xD1, 0x17, 0x6B ),
200
};
201
static const t_uint secp256r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
202 203 204 205
    BYTES_TO_T_UINT_8( 0xF5, 0x51, 0xBF, 0x37, 0x68, 0x40, 0xB6, 0xCB ),
    BYTES_TO_T_UINT_8( 0xCE, 0x5E, 0x31, 0x6B, 0x57, 0x33, 0xCE, 0x2B ),
    BYTES_TO_T_UINT_8( 0x16, 0x9E, 0x0F, 0x7C, 0x4A, 0xEB, 0xE7, 0x8E ),
    BYTES_TO_T_UINT_8( 0x9B, 0x7F, 0x1A, 0xFE, 0xE2, 0x42, 0xE3, 0x4F ),
206
};
207
static const t_uint secp256r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
208 209 210 211
    BYTES_TO_T_UINT_8( 0x51, 0x25, 0x63, 0xFC, 0xC2, 0xCA, 0xB9, 0xF3 ),
    BYTES_TO_T_UINT_8( 0x84, 0x9E, 0x17, 0xA7, 0xAD, 0xFA, 0xE6, 0xBC ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
212
};
213
#endif /* POLARSSL_ECP_DP_SECP256R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
214 215 216 217

/*
 * Domain parameters for secp384r1
 */
218
#if defined(POLARSSL_ECP_DP_SECP384R1_ENABLED)
219
static const t_uint secp384r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
220 221 222 223 224 225
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
    BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
226
};
227
static const t_uint secp384r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
228 229 230 231 232 233
    BYTES_TO_T_UINT_8( 0xEF, 0x2A, 0xEC, 0xD3, 0xED, 0xC8, 0x85, 0x2A ),
    BYTES_TO_T_UINT_8( 0x9D, 0xD1, 0x2E, 0x8A, 0x8D, 0x39, 0x56, 0xC6 ),
    BYTES_TO_T_UINT_8( 0x5A, 0x87, 0x13, 0x50, 0x8F, 0x08, 0x14, 0x03 ),
    BYTES_TO_T_UINT_8( 0x12, 0x41, 0x81, 0xFE, 0x6E, 0x9C, 0x1D, 0x18 ),
    BYTES_TO_T_UINT_8( 0x19, 0x2D, 0xF8, 0xE3, 0x6B, 0x05, 0x8E, 0x98 ),
    BYTES_TO_T_UINT_8( 0xE4, 0xE7, 0x3E, 0xE2, 0xA7, 0x2F, 0x31, 0xB3 ),
234
};
235
static const t_uint secp384r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
236 237 238 239 240 241
    BYTES_TO_T_UINT_8( 0xB7, 0x0A, 0x76, 0x72, 0x38, 0x5E, 0x54, 0x3A ),
    BYTES_TO_T_UINT_8( 0x6C, 0x29, 0x55, 0xBF, 0x5D, 0xF2, 0x02, 0x55 ),
    BYTES_TO_T_UINT_8( 0x38, 0x2A, 0x54, 0x82, 0xE0, 0x41, 0xF7, 0x59 ),
    BYTES_TO_T_UINT_8( 0x98, 0x9B, 0xA7, 0x8B, 0x62, 0x3B, 0x1D, 0x6E ),
    BYTES_TO_T_UINT_8( 0x74, 0xAD, 0x20, 0xF3, 0x1E, 0xC7, 0xB1, 0x8E ),
    BYTES_TO_T_UINT_8( 0x37, 0x05, 0x8B, 0xBE, 0x22, 0xCA, 0x87, 0xAA ),
242
};
243
static const t_uint secp384r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
244 245 246 247 248 249
    BYTES_TO_T_UINT_8( 0x5F, 0x0E, 0xEA, 0x90, 0x7C, 0x1D, 0x43, 0x7A ),
    BYTES_TO_T_UINT_8( 0x9D, 0x81, 0x7E, 0x1D, 0xCE, 0xB1, 0x60, 0x0A ),
    BYTES_TO_T_UINT_8( 0xC0, 0xB8, 0xF0, 0xB5, 0x13, 0x31, 0xDA, 0xE9 ),
    BYTES_TO_T_UINT_8( 0x7C, 0x14, 0x9A, 0x28, 0xBD, 0x1D, 0xF4, 0xF8 ),
    BYTES_TO_T_UINT_8( 0x29, 0xDC, 0x92, 0x92, 0xBF, 0x98, 0x9E, 0x5D ),
    BYTES_TO_T_UINT_8( 0x6F, 0x2C, 0x26, 0x96, 0x4A, 0xDE, 0x17, 0x36 ),
250
};
251
static const t_uint secp384r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
252 253 254 255 256 257
    BYTES_TO_T_UINT_8( 0x73, 0x29, 0xC5, 0xCC, 0x6A, 0x19, 0xEC, 0xEC ),
    BYTES_TO_T_UINT_8( 0x7A, 0xA7, 0xB0, 0x48, 0xB2, 0x0D, 0x1A, 0x58 ),
    BYTES_TO_T_UINT_8( 0xDF, 0x2D, 0x37, 0xF4, 0x81, 0x4D, 0x63, 0xC7 ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
258
};
259
#endif /* POLARSSL_ECP_DP_SECP384R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
260 261 262 263

/*
 * Domain parameters for secp521r1
 */
264
#if defined(POLARSSL_ECP_DP_SECP521R1_ENABLED)
265
static const t_uint secp521r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
266 267 268 269 270 271 272 273
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
274
    BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
275
};
276
static const t_uint secp521r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
277 278 279 280 281 282 283 284
    BYTES_TO_T_UINT_8( 0x00, 0x3F, 0x50, 0x6B, 0xD4, 0x1F, 0x45, 0xEF ),
    BYTES_TO_T_UINT_8( 0xF1, 0x34, 0x2C, 0x3D, 0x88, 0xDF, 0x73, 0x35 ),
    BYTES_TO_T_UINT_8( 0x07, 0xBF, 0xB1, 0x3B, 0xBD, 0xC0, 0x52, 0x16 ),
    BYTES_TO_T_UINT_8( 0x7B, 0x93, 0x7E, 0xEC, 0x51, 0x39, 0x19, 0x56 ),
    BYTES_TO_T_UINT_8( 0xE1, 0x09, 0xF1, 0x8E, 0x91, 0x89, 0xB4, 0xB8 ),
    BYTES_TO_T_UINT_8( 0xF3, 0x15, 0xB3, 0x99, 0x5B, 0x72, 0xDA, 0xA2 ),
    BYTES_TO_T_UINT_8( 0xEE, 0x40, 0x85, 0xB6, 0xA0, 0x21, 0x9A, 0x92 ),
    BYTES_TO_T_UINT_8( 0x1F, 0x9A, 0x1C, 0x8E, 0x61, 0xB9, 0x3E, 0x95 ),
285
    BYTES_TO_T_UINT_2( 0x51, 0x00 ),
286
};
287
static const t_uint secp521r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
288 289 290 291 292 293 294 295
    BYTES_TO_T_UINT_8( 0x66, 0xBD, 0xE5, 0xC2, 0x31, 0x7E, 0x7E, 0xF9 ),
    BYTES_TO_T_UINT_8( 0x9B, 0x42, 0x6A, 0x85, 0xC1, 0xB3, 0x48, 0x33 ),
    BYTES_TO_T_UINT_8( 0xDE, 0xA8, 0xFF, 0xA2, 0x27, 0xC1, 0x1D, 0xFE ),
    BYTES_TO_T_UINT_8( 0x28, 0x59, 0xE7, 0xEF, 0x77, 0x5E, 0x4B, 0xA1 ),
    BYTES_TO_T_UINT_8( 0xBA, 0x3D, 0x4D, 0x6B, 0x60, 0xAF, 0x28, 0xF8 ),
    BYTES_TO_T_UINT_8( 0x21, 0xB5, 0x3F, 0x05, 0x39, 0x81, 0x64, 0x9C ),
    BYTES_TO_T_UINT_8( 0x42, 0xB4, 0x95, 0x23, 0x66, 0xCB, 0x3E, 0x9E ),
    BYTES_TO_T_UINT_8( 0xCD, 0xE9, 0x04, 0x04, 0xB7, 0x06, 0x8E, 0x85 ),
296
    BYTES_TO_T_UINT_2( 0xC6, 0x00 ),
297
};
298
static const t_uint secp521r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
299 300 301 302 303 304 305 306
    BYTES_TO_T_UINT_8( 0x50, 0x66, 0xD1, 0x9F, 0x76, 0x94, 0xBE, 0x88 ),
    BYTES_TO_T_UINT_8( 0x40, 0xC2, 0x72, 0xA2, 0x86, 0x70, 0x3C, 0x35 ),
    BYTES_TO_T_UINT_8( 0x61, 0x07, 0xAD, 0x3F, 0x01, 0xB9, 0x50, 0xC5 ),
    BYTES_TO_T_UINT_8( 0x40, 0x26, 0xF4, 0x5E, 0x99, 0x72, 0xEE, 0x97 ),
    BYTES_TO_T_UINT_8( 0x2C, 0x66, 0x3E, 0x27, 0x17, 0xBD, 0xAF, 0x17 ),
    BYTES_TO_T_UINT_8( 0x68, 0x44, 0x9B, 0x57, 0x49, 0x44, 0xF5, 0x98 ),
    BYTES_TO_T_UINT_8( 0xD9, 0x1B, 0x7D, 0x2C, 0xB4, 0x5F, 0x8A, 0x5C ),
    BYTES_TO_T_UINT_8( 0x04, 0xC0, 0x3B, 0x9A, 0x78, 0x6A, 0x29, 0x39 ),
307
    BYTES_TO_T_UINT_2( 0x18, 0x01 ),
308
};
309
static const t_uint secp521r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
310 311 312 313 314 315 316 317
    BYTES_TO_T_UINT_8( 0x09, 0x64, 0x38, 0x91, 0x1E, 0xB7, 0x6F, 0xBB ),
    BYTES_TO_T_UINT_8( 0xAE, 0x47, 0x9C, 0x89, 0xB8, 0xC9, 0xB5, 0x3B ),
    BYTES_TO_T_UINT_8( 0xD0, 0xA5, 0x09, 0xF7, 0x48, 0x01, 0xCC, 0x7F ),
    BYTES_TO_T_UINT_8( 0x6B, 0x96, 0x2F, 0xBF, 0x83, 0x87, 0x86, 0x51 ),
    BYTES_TO_T_UINT_8( 0xFA, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
318
    BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
319
};
320
#endif /* POLARSSL_ECP_DP_SECP521R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
321

322
#if defined(POLARSSL_ECP_DP_SECP192K1_ENABLED)
323
static const t_uint secp192k1_p[] = {
324 325 326 327
    BYTES_TO_T_UINT_8( 0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
};
328
static const t_uint secp192k1_a[] = {
329 330
    BYTES_TO_T_UINT_2( 0x00, 0x00 ),
};
331
static const t_uint secp192k1_b[] = {
332 333
    BYTES_TO_T_UINT_2( 0x03, 0x00 ),
};
334
static const t_uint secp192k1_gx[] = {
335 336 337 338
    BYTES_TO_T_UINT_8( 0x7D, 0x6C, 0xE0, 0xEA, 0xB1, 0xD1, 0xA5, 0x1D ),
    BYTES_TO_T_UINT_8( 0x34, 0xF4, 0xB7, 0x80, 0x02, 0x7D, 0xB0, 0x26 ),
    BYTES_TO_T_UINT_8( 0xAE, 0xE9, 0x57, 0xC0, 0x0E, 0xF1, 0x4F, 0xDB ),
};
339
static const t_uint secp192k1_gy[] = {
340 341 342 343
    BYTES_TO_T_UINT_8( 0x9D, 0x2F, 0x5E, 0xD9, 0x88, 0xAA, 0x82, 0x40 ),
    BYTES_TO_T_UINT_8( 0x34, 0x86, 0xBE, 0x15, 0xD0, 0x63, 0x41, 0x84 ),
    BYTES_TO_T_UINT_8( 0xA7, 0x28, 0x56, 0x9C, 0x6D, 0x2F, 0x2F, 0x9B ),
};
344
static const t_uint secp192k1_n[] = {
345 346 347 348 349 350
    BYTES_TO_T_UINT_8( 0x8D, 0xFD, 0xDE, 0x74, 0x6A, 0x46, 0x69, 0x0F ),
    BYTES_TO_T_UINT_8( 0x17, 0xFC, 0xF2, 0x26, 0xFE, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
};
#endif /* POLARSSL_ECP_DP_SECP192K1_ENABLED */

351
#if defined(POLARSSL_ECP_DP_SECP224K1_ENABLED)
352
static const t_uint secp224k1_p[] = {
353 354 355 356 357
    BYTES_TO_T_UINT_8( 0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
};
358
static const t_uint secp224k1_a[] = {
359 360
    BYTES_TO_T_UINT_2( 0x00, 0x00 ),
};
361
static const t_uint secp224k1_b[] = {
362 363
    BYTES_TO_T_UINT_2( 0x05, 0x00 ),
};
364
static const t_uint secp224k1_gx[] = {
365 366 367 368 369
    BYTES_TO_T_UINT_8( 0x5C, 0xA4, 0xB7, 0xB6, 0x0E, 0x65, 0x7E, 0x0F ),
    BYTES_TO_T_UINT_8( 0xA9, 0x75, 0x70, 0xE4, 0xE9, 0x67, 0xA4, 0x69 ),
    BYTES_TO_T_UINT_8( 0xA1, 0x28, 0xFC, 0x30, 0xDF, 0x99, 0xF0, 0x4D ),
    BYTES_TO_T_UINT_4( 0x33, 0x5B, 0x45, 0xA1 ),
};
370
static const t_uint secp224k1_gy[] = {
371 372 373 374 375
    BYTES_TO_T_UINT_8( 0xA5, 0x61, 0x6D, 0x55, 0xDB, 0x4B, 0xCA, 0xE2 ),
    BYTES_TO_T_UINT_8( 0x59, 0xBD, 0xB0, 0xC0, 0xF7, 0x19, 0xE3, 0xF7 ),
    BYTES_TO_T_UINT_8( 0xD6, 0xFB, 0xCA, 0x82, 0x42, 0x34, 0xBA, 0x7F ),
    BYTES_TO_T_UINT_4( 0xED, 0x9F, 0x08, 0x7E ),
};
376
static const t_uint secp224k1_n[] = {
377 378 379 380 381 382 383
    BYTES_TO_T_UINT_8( 0xF7, 0xB1, 0x9F, 0x76, 0x71, 0xA9, 0xF0, 0xCA ),
    BYTES_TO_T_UINT_8( 0x84, 0x61, 0xEC, 0xD2, 0xE8, 0xDC, 0x01, 0x00 ),
    BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
    BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ),
};
#endif /* POLARSSL_ECP_DP_SECP224K1_ENABLED */

384
#if defined(POLARSSL_ECP_DP_SECP256K1_ENABLED)
385
static const t_uint secp256k1_p[] = {
386 387 388 389 390
    BYTES_TO_T_UINT_8( 0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
};
391
static const t_uint secp256k1_a[] = {
392 393
    BYTES_TO_T_UINT_2( 0x00, 0x00 ),
};
394
static const t_uint secp256k1_b[] = {
395 396
    BYTES_TO_T_UINT_2( 0x07, 0x00 ),
};
397
static const t_uint secp256k1_gx[] = {
398 399 400 401 402
    BYTES_TO_T_UINT_8( 0x98, 0x17, 0xF8, 0x16, 0x5B, 0x81, 0xF2, 0x59 ),
    BYTES_TO_T_UINT_8( 0xD9, 0x28, 0xCE, 0x2D, 0xDB, 0xFC, 0x9B, 0x02 ),
    BYTES_TO_T_UINT_8( 0x07, 0x0B, 0x87, 0xCE, 0x95, 0x62, 0xA0, 0x55 ),
    BYTES_TO_T_UINT_8( 0xAC, 0xBB, 0xDC, 0xF9, 0x7E, 0x66, 0xBE, 0x79 ),
};
403
static const t_uint secp256k1_gy[] = {
404 405 406 407 408
    BYTES_TO_T_UINT_8( 0xB8, 0xD4, 0x10, 0xFB, 0x8F, 0xD0, 0x47, 0x9C ),
    BYTES_TO_T_UINT_8( 0x19, 0x54, 0x85, 0xA6, 0x48, 0xB4, 0x17, 0xFD ),
    BYTES_TO_T_UINT_8( 0xA8, 0x08, 0x11, 0x0E, 0xFC, 0xFB, 0xA4, 0x5D ),
    BYTES_TO_T_UINT_8( 0x65, 0xC4, 0xA3, 0x26, 0x77, 0xDA, 0x3A, 0x48 ),
};
409
static const t_uint secp256k1_n[] = {
410 411 412 413 414 415 416
    BYTES_TO_T_UINT_8( 0x41, 0x41, 0x36, 0xD0, 0x8C, 0x5E, 0xD2, 0xBF ),
    BYTES_TO_T_UINT_8( 0x3B, 0xA0, 0x48, 0xAF, 0xE6, 0xDC, 0xAE, 0xBA ),
    BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
    BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
};
#endif /* POLARSSL_ECP_DP_SECP256K1_ENABLED */

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
417 418 419
/*
 * Domain parameters for brainpoolP256r1 (RFC 5639 3.4)
 */
420
#if defined(POLARSSL_ECP_DP_BP256R1_ENABLED)
421
static const t_uint brainpoolP256r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
422 423 424 425
    BYTES_TO_T_UINT_8( 0x77, 0x53, 0x6E, 0x1F, 0x1D, 0x48, 0x13, 0x20 ),
    BYTES_TO_T_UINT_8( 0x28, 0x20, 0x26, 0xD5, 0x23, 0xF6, 0x3B, 0x6E ),
    BYTES_TO_T_UINT_8( 0x72, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
    BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
426
};
427
static const t_uint brainpoolP256r1_a[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
428 429 430 431
    BYTES_TO_T_UINT_8( 0xD9, 0xB5, 0x30, 0xF3, 0x44, 0x4B, 0x4A, 0xE9 ),
    BYTES_TO_T_UINT_8( 0x6C, 0x5C, 0xDC, 0x26, 0xC1, 0x55, 0x80, 0xFB ),
    BYTES_TO_T_UINT_8( 0xE7, 0xFF, 0x7A, 0x41, 0x30, 0x75, 0xF6, 0xEE ),
    BYTES_TO_T_UINT_8( 0x57, 0x30, 0x2C, 0xFC, 0x75, 0x09, 0x5A, 0x7D ),
432
};
433
static const t_uint brainpoolP256r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
434 435 436 437
    BYTES_TO_T_UINT_8( 0xB6, 0x07, 0x8C, 0xFF, 0x18, 0xDC, 0xCC, 0x6B ),
    BYTES_TO_T_UINT_8( 0xCE, 0xE1, 0xF7, 0x5C, 0x29, 0x16, 0x84, 0x95 ),
    BYTES_TO_T_UINT_8( 0xBF, 0x7C, 0xD7, 0xBB, 0xD9, 0xB5, 0x30, 0xF3 ),
    BYTES_TO_T_UINT_8( 0x44, 0x4B, 0x4A, 0xE9, 0x6C, 0x5C, 0xDC, 0x26 ),
438
};
439
static const t_uint brainpoolP256r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
440 441 442 443
    BYTES_TO_T_UINT_8( 0x62, 0x32, 0xCE, 0x9A, 0xBD, 0x53, 0x44, 0x3A ),
    BYTES_TO_T_UINT_8( 0xC2, 0x23, 0xBD, 0xE3, 0xE1, 0x27, 0xDE, 0xB9 ),
    BYTES_TO_T_UINT_8( 0xAF, 0xB7, 0x81, 0xFC, 0x2F, 0x48, 0x4B, 0x2C ),
    BYTES_TO_T_UINT_8( 0xCB, 0x57, 0x7E, 0xCB, 0xB9, 0xAE, 0xD2, 0x8B ),
444
};
445
static const t_uint brainpoolP256r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
446 447 448 449
    BYTES_TO_T_UINT_8( 0x97, 0x69, 0x04, 0x2F, 0xC7, 0x54, 0x1D, 0x5C ),
    BYTES_TO_T_UINT_8( 0x54, 0x8E, 0xED, 0x2D, 0x13, 0x45, 0x77, 0xC2 ),
    BYTES_TO_T_UINT_8( 0xC9, 0x1D, 0x61, 0x14, 0x1A, 0x46, 0xF8, 0x97 ),
    BYTES_TO_T_UINT_8( 0xFD, 0xC4, 0xDA, 0xC3, 0x35, 0xF8, 0x7E, 0x54 ),
450
};
451
static const t_uint brainpoolP256r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
452 453 454 455
    BYTES_TO_T_UINT_8( 0xA7, 0x56, 0x48, 0x97, 0x82, 0x0E, 0x1E, 0x90 ),
    BYTES_TO_T_UINT_8( 0xF7, 0xA6, 0x61, 0xB5, 0xA3, 0x7A, 0x39, 0x8C ),
    BYTES_TO_T_UINT_8( 0x71, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
    BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
456
};
457
#endif /* POLARSSL_ECP_DP_BP256R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
458 459 460 461

/*
 * Domain parameters for brainpoolP384r1 (RFC 5639 3.6)
 */
462
#if defined(POLARSSL_ECP_DP_BP384R1_ENABLED)
463
static const t_uint brainpoolP384r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
464 465 466 467 468 469
    BYTES_TO_T_UINT_8( 0x53, 0xEC, 0x07, 0x31, 0x13, 0x00, 0x47, 0x87 ),
    BYTES_TO_T_UINT_8( 0x71, 0x1A, 0x1D, 0x90, 0x29, 0xA7, 0xD3, 0xAC ),
    BYTES_TO_T_UINT_8( 0x23, 0x11, 0xB7, 0x7F, 0x19, 0xDA, 0xB1, 0x12 ),
    BYTES_TO_T_UINT_8( 0xB4, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
    BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
    BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
470
};
471
static const t_uint brainpoolP384r1_a[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
472 473 474 475 476 477
    BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
    BYTES_TO_T_UINT_8( 0xEB, 0xD4, 0x3A, 0x50, 0x4A, 0x81, 0xA5, 0x8A ),
    BYTES_TO_T_UINT_8( 0x0F, 0xF9, 0x91, 0xBA, 0xEF, 0x65, 0x91, 0x13 ),
    BYTES_TO_T_UINT_8( 0x87, 0x27, 0xB2, 0x4F, 0x8E, 0xA2, 0xBE, 0xC2 ),
    BYTES_TO_T_UINT_8( 0xA0, 0xAF, 0x05, 0xCE, 0x0A, 0x08, 0x72, 0x3C ),
    BYTES_TO_T_UINT_8( 0x0C, 0x15, 0x8C, 0x3D, 0xC6, 0x82, 0xC3, 0x7B ),
478
};
479
static const t_uint brainpoolP384r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
480 481 482 483 484 485
    BYTES_TO_T_UINT_8( 0x11, 0x4C, 0x50, 0xFA, 0x96, 0x86, 0xB7, 0x3A ),
    BYTES_TO_T_UINT_8( 0x94, 0xC9, 0xDB, 0x95, 0x02, 0x39, 0xB4, 0x7C ),
    BYTES_TO_T_UINT_8( 0xD5, 0x62, 0xEB, 0x3E, 0xA5, 0x0E, 0x88, 0x2E ),
    BYTES_TO_T_UINT_8( 0xA6, 0xD2, 0xDC, 0x07, 0xE1, 0x7D, 0xB7, 0x2F ),
    BYTES_TO_T_UINT_8( 0x7C, 0x44, 0xF0, 0x16, 0x54, 0xB5, 0x39, 0x8B ),
    BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
486
};
487
static const t_uint brainpoolP384r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
488 489 490 491 492 493
    BYTES_TO_T_UINT_8( 0x1E, 0xAF, 0xD4, 0x47, 0xE2, 0xB2, 0x87, 0xEF ),
    BYTES_TO_T_UINT_8( 0xAA, 0x46, 0xD6, 0x36, 0x34, 0xE0, 0x26, 0xE8 ),
    BYTES_TO_T_UINT_8( 0xE8, 0x10, 0xBD, 0x0C, 0xFE, 0xCA, 0x7F, 0xDB ),
    BYTES_TO_T_UINT_8( 0xE3, 0x4F, 0xF1, 0x7E, 0xE7, 0xA3, 0x47, 0x88 ),
    BYTES_TO_T_UINT_8( 0x6B, 0x3F, 0xC1, 0xB7, 0x81, 0x3A, 0xA6, 0xA2 ),
    BYTES_TO_T_UINT_8( 0xFF, 0x45, 0xCF, 0x68, 0xF0, 0x64, 0x1C, 0x1D ),
494
};
495
static const t_uint brainpoolP384r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
496 497 498 499 500 501
    BYTES_TO_T_UINT_8( 0x15, 0x53, 0x3C, 0x26, 0x41, 0x03, 0x82, 0x42 ),
    BYTES_TO_T_UINT_8( 0x11, 0x81, 0x91, 0x77, 0x21, 0x46, 0x46, 0x0E ),
    BYTES_TO_T_UINT_8( 0x28, 0x29, 0x91, 0xF9, 0x4F, 0x05, 0x9C, 0xE1 ),
    BYTES_TO_T_UINT_8( 0x64, 0x58, 0xEC, 0xFE, 0x29, 0x0B, 0xB7, 0x62 ),
    BYTES_TO_T_UINT_8( 0x52, 0xD5, 0xCF, 0x95, 0x8E, 0xEB, 0xB1, 0x5C ),
    BYTES_TO_T_UINT_8( 0xA4, 0xC2, 0xF9, 0x20, 0x75, 0x1D, 0xBE, 0x8A ),
502
};
503
static const t_uint brainpoolP384r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
504 505 506 507 508 509
    BYTES_TO_T_UINT_8( 0x65, 0x65, 0x04, 0xE9, 0x02, 0x32, 0x88, 0x3B ),
    BYTES_TO_T_UINT_8( 0x10, 0xC3, 0x7F, 0x6B, 0xAF, 0xB6, 0x3A, 0xCF ),
    BYTES_TO_T_UINT_8( 0xA7, 0x25, 0x04, 0xAC, 0x6C, 0x6E, 0x16, 0x1F ),
    BYTES_TO_T_UINT_8( 0xB3, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
    BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
    BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
510
};
511
#endif /* POLARSSL_ECP_DP_BP384R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
512 513 514 515

/*
 * Domain parameters for brainpoolP512r1 (RFC 5639 3.7)
 */
516
#if defined(POLARSSL_ECP_DP_BP512R1_ENABLED)
517
static const t_uint brainpoolP512r1_p[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
518 519 520 521 522 523 524 525
    BYTES_TO_T_UINT_8( 0xF3, 0x48, 0x3A, 0x58, 0x56, 0x60, 0xAA, 0x28 ),
    BYTES_TO_T_UINT_8( 0x85, 0xC6, 0x82, 0x2D, 0x2F, 0xFF, 0x81, 0x28 ),
    BYTES_TO_T_UINT_8( 0xE6, 0x80, 0xA3, 0xE6, 0x2A, 0xA1, 0xCD, 0xAE ),
    BYTES_TO_T_UINT_8( 0x42, 0x68, 0xC6, 0x9B, 0x00, 0x9B, 0x4D, 0x7D ),
    BYTES_TO_T_UINT_8( 0x71, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
    BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
    BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
    BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
526
};
527
static const t_uint brainpoolP512r1_a[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
528 529 530 531 532 533 534 535
    BYTES_TO_T_UINT_8( 0xCA, 0x94, 0xFC, 0x77, 0x4D, 0xAC, 0xC1, 0xE7 ),
    BYTES_TO_T_UINT_8( 0xB9, 0xC7, 0xF2, 0x2B, 0xA7, 0x17, 0x11, 0x7F ),
    BYTES_TO_T_UINT_8( 0xB5, 0xC8, 0x9A, 0x8B, 0xC9, 0xF1, 0x2E, 0x0A ),
    BYTES_TO_T_UINT_8( 0xA1, 0x3A, 0x25, 0xA8, 0x5A, 0x5D, 0xED, 0x2D ),
    BYTES_TO_T_UINT_8( 0xBC, 0x63, 0x98, 0xEA, 0xCA, 0x41, 0x34, 0xA8 ),
    BYTES_TO_T_UINT_8( 0x10, 0x16, 0xF9, 0x3D, 0x8D, 0xDD, 0xCB, 0x94 ),
    BYTES_TO_T_UINT_8( 0xC5, 0x4C, 0x23, 0xAC, 0x45, 0x71, 0x32, 0xE2 ),
    BYTES_TO_T_UINT_8( 0x89, 0x3B, 0x60, 0x8B, 0x31, 0xA3, 0x30, 0x78 ),
536
};
537
static const t_uint brainpoolP512r1_b[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
538 539 540 541 542 543 544 545
    BYTES_TO_T_UINT_8( 0x23, 0xF7, 0x16, 0x80, 0x63, 0xBD, 0x09, 0x28 ),
    BYTES_TO_T_UINT_8( 0xDD, 0xE5, 0xBA, 0x5E, 0xB7, 0x50, 0x40, 0x98 ),
    BYTES_TO_T_UINT_8( 0x67, 0x3E, 0x08, 0xDC, 0xCA, 0x94, 0xFC, 0x77 ),
    BYTES_TO_T_UINT_8( 0x4D, 0xAC, 0xC1, 0xE7, 0xB9, 0xC7, 0xF2, 0x2B ),
    BYTES_TO_T_UINT_8( 0xA7, 0x17, 0x11, 0x7F, 0xB5, 0xC8, 0x9A, 0x8B ),
    BYTES_TO_T_UINT_8( 0xC9, 0xF1, 0x2E, 0x0A, 0xA1, 0x3A, 0x25, 0xA8 ),
    BYTES_TO_T_UINT_8( 0x5A, 0x5D, 0xED, 0x2D, 0xBC, 0x63, 0x98, 0xEA ),
    BYTES_TO_T_UINT_8( 0xCA, 0x41, 0x34, 0xA8, 0x10, 0x16, 0xF9, 0x3D ),
546
};
547
static const t_uint brainpoolP512r1_gx[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
548 549 550 551 552 553 554 555
    BYTES_TO_T_UINT_8( 0x22, 0xF8, 0xB9, 0xBC, 0x09, 0x22, 0x35, 0x8B ),
    BYTES_TO_T_UINT_8( 0x68, 0x5E, 0x6A, 0x40, 0x47, 0x50, 0x6D, 0x7C ),
    BYTES_TO_T_UINT_8( 0x5F, 0x7D, 0xB9, 0x93, 0x7B, 0x68, 0xD1, 0x50 ),
    BYTES_TO_T_UINT_8( 0x8D, 0xD4, 0xD0, 0xE2, 0x78, 0x1F, 0x3B, 0xFF ),
    BYTES_TO_T_UINT_8( 0x8E, 0x09, 0xD0, 0xF4, 0xEE, 0x62, 0x3B, 0xB4 ),
    BYTES_TO_T_UINT_8( 0xC1, 0x16, 0xD9, 0xB5, 0x70, 0x9F, 0xED, 0x85 ),
    BYTES_TO_T_UINT_8( 0x93, 0x6A, 0x4C, 0x9C, 0x2E, 0x32, 0x21, 0x5A ),
    BYTES_TO_T_UINT_8( 0x64, 0xD9, 0x2E, 0xD8, 0xBD, 0xE4, 0xAE, 0x81 ),
556
};
557
static const t_uint brainpoolP512r1_gy[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
558 559 560 561 562 563 564 565
    BYTES_TO_T_UINT_8( 0x92, 0x08, 0xD8, 0x3A, 0x0F, 0x1E, 0xCD, 0x78 ),
    BYTES_TO_T_UINT_8( 0x06, 0x54, 0xF0, 0xA8, 0x2F, 0x2B, 0xCA, 0xD1 ),
    BYTES_TO_T_UINT_8( 0xAE, 0x63, 0x27, 0x8A, 0xD8, 0x4B, 0xCA, 0x5B ),
    BYTES_TO_T_UINT_8( 0x5E, 0x48, 0x5F, 0x4A, 0x49, 0xDE, 0xDC, 0xB2 ),
    BYTES_TO_T_UINT_8( 0x11, 0x81, 0x1F, 0x88, 0x5B, 0xC5, 0x00, 0xA0 ),
    BYTES_TO_T_UINT_8( 0x1A, 0x7B, 0xA5, 0x24, 0x00, 0xF7, 0x09, 0xF2 ),
    BYTES_TO_T_UINT_8( 0xFD, 0x22, 0x78, 0xCF, 0xA9, 0xBF, 0xEA, 0xC0 ),
    BYTES_TO_T_UINT_8( 0xEC, 0x32, 0x63, 0x56, 0x5D, 0x38, 0xDE, 0x7D ),
566
};
567
static const t_uint brainpoolP512r1_n[] = {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
568 569 570 571 572 573 574 575
    BYTES_TO_T_UINT_8( 0x69, 0x00, 0xA9, 0x9C, 0x82, 0x96, 0x87, 0xB5 ),
    BYTES_TO_T_UINT_8( 0xDD, 0xDA, 0x5D, 0x08, 0x81, 0xD3, 0xB1, 0x1D ),
    BYTES_TO_T_UINT_8( 0x47, 0x10, 0xAC, 0x7F, 0x19, 0x61, 0x86, 0x41 ),
    BYTES_TO_T_UINT_8( 0x19, 0x26, 0xA9, 0x4C, 0x41, 0x5C, 0x3E, 0x55 ),
    BYTES_TO_T_UINT_8( 0x70, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
    BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
    BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
    BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
576
};
577
#endif /* POLARSSL_ECP_DP_BP512R1_ENABLED */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
578 579

/*
580 581
 * Create an MPI from embedded constants
 * (assumes len is an exact multiple of sizeof t_uint)
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
582
 */
583 584 585 586 587 588 589
static inline void ecp_mpi_load( mpi *X, const t_uint *p, size_t len )
{
    X->s = 1;
    X->n = len / sizeof( t_uint );
    X->p = (t_uint *) p;
}

590 591 592 593 594 595 596 597 598 599 600
/*
 * Set an MPI to static value 1
 */
static inline void ecp_mpi_set1( mpi *X )
{
    static t_uint one[] = { 1 };
    X->s = 1;
    X->n = 1;
    X->p = one;
}

601 602 603 604 605 606 607 608 609 610
/*
 * Make group available from embedded constants
 */
static int ecp_group_load( ecp_group *grp,
                           const t_uint *p,  size_t plen,
                           const t_uint *a,  size_t alen,
                           const t_uint *b,  size_t blen,
                           const t_uint *gx, size_t gxlen,
                           const t_uint *gy, size_t gylen,
                           const t_uint *n,  size_t nlen)
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
611
{
612
    ecp_mpi_load( &grp->P, p, plen );
613
    if( a != NULL )
614 615 616
        ecp_mpi_load( &grp->A, a, alen );
    ecp_mpi_load( &grp->B, b, blen );
    ecp_mpi_load( &grp->N, n, nlen );
617

618 619
    ecp_mpi_load( &grp->G.X, gx, gxlen );
    ecp_mpi_load( &grp->G.Y, gy, gylen );
620
    ecp_mpi_set1( &grp->G.Z );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
621 622 623 624

    grp->pbits = mpi_msb( &grp->P );
    grp->nbits = mpi_msb( &grp->N );

625 626
    grp->h = 1;

627
    return( 0 );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
628 629 630 631
}

#if defined(POLARSSL_ECP_NIST_OPTIM)
/* Forward declarations */
632
#if defined(POLARSSL_ECP_DP_SECP192R1_ENABLED)
633
static int ecp_mod_p192( mpi * );
634 635
#endif
#if defined(POLARSSL_ECP_DP_SECP224R1_ENABLED)
636
static int ecp_mod_p224( mpi * );
637 638
#endif
#if defined(POLARSSL_ECP_DP_SECP256R1_ENABLED)
639
static int ecp_mod_p256( mpi * );
640 641
#endif
#if defined(POLARSSL_ECP_DP_SECP384R1_ENABLED)
642
static int ecp_mod_p384( mpi * );
643 644
#endif
#if defined(POLARSSL_ECP_DP_SECP521R1_ENABLED)
645
static int ecp_mod_p521( mpi * );
646
#endif
647 648 649 650

#define NIST_MODP( P )      grp->modp = ecp_mod_ ## P;
#else
#define NIST_MODP( P )
651
#endif /* POLARSSL_ECP_NIST_OPTIM */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
652

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
653 654 655 656
/* Additional forward declarations */
#if defined(POLARSSL_ECP_DP_M255_ENABLED)
static int ecp_mod_p255( mpi * );
#endif
657 658 659 660 661 662
#if defined(POLARSSL_ECP_DP_SECP192K1_ENABLED)
static int ecp_mod_p192k1( mpi * );
#endif
#if defined(POLARSSL_ECP_DP_SECP224K1_ENABLED)
static int ecp_mod_p224k1( mpi * );
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
663 664 665 666
#if defined(POLARSSL_ECP_DP_SECP256K1_ENABLED)
static int ecp_mod_p256k1( mpi * );
#endif

667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682
#define LOAD_GROUP_A( G )   ecp_group_load( grp,            \
                            G ## _p,  sizeof( G ## _p  ),   \
                            G ## _a,  sizeof( G ## _a  ),   \
                            G ## _b,  sizeof( G ## _b  ),   \
                            G ## _gx, sizeof( G ## _gx ),   \
                            G ## _gy, sizeof( G ## _gy ),   \
                            G ## _n,  sizeof( G ## _n  ) )

#define LOAD_GROUP( G )     ecp_group_load( grp,            \
                            G ## _p,  sizeof( G ## _p  ),   \
                            NULL,     0,                    \
                            G ## _b,  sizeof( G ## _b  ),   \
                            G ## _gx, sizeof( G ## _gx ),   \
                            G ## _gy, sizeof( G ## _gy ),   \
                            G ## _n,  sizeof( G ## _n  ) )

683
#if defined(POLARSSL_ECP_DP_M255_ENABLED)
684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699
/*
 * Specialized function for creating the Curve25519 group
 */
static int ecp_use_curve25519( ecp_group *grp )
{
    int ret;

    /* Actually ( A + 2 ) / 4 */
    MPI_CHK( mpi_read_string( &grp->A, 16, "01DB42" ) );

    /* P = 2^255 - 19 */
    MPI_CHK( mpi_lset( &grp->P, 1 ) );
    MPI_CHK( mpi_shift_l( &grp->P, 255 ) );
    MPI_CHK( mpi_sub_int( &grp->P, &grp->P, 19 ) );
    grp->pbits = mpi_msb( &grp->P );

700 701 702 703 704 705
    /* Y intentionaly not set, since we use x/z coordinates.
     * This is used as a marker to identify Montgomery curves! */
    MPI_CHK( mpi_lset( &grp->G.X, 9 ) );
    MPI_CHK( mpi_lset( &grp->G.Z, 1 ) );
    mpi_free( &grp->G.Y );

706 707 708 709 710 711 712 713 714
    /* Actually, the required msb for private keys */
    grp->nbits = 254;

cleanup:
    if( ret != 0 )
        ecp_group_free( grp );

    return( ret );
}
715
#endif /* POLARSSL_ECP_DP_M255_ENABLED */
716

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
717 718 719 720 721
/*
 * Set a group using well-known domain parameters
 */
int ecp_use_known_dp( ecp_group *grp, ecp_group_id id )
{
722 723
    ecp_group_free( grp );

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
724 725 726 727 728 729
    grp->id = id;

    switch( id )
    {
#if defined(POLARSSL_ECP_DP_SECP192R1_ENABLED)
        case POLARSSL_ECP_DP_SECP192R1:
730
            NIST_MODP( p192 );
731
            return( LOAD_GROUP( secp192r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
732 733 734 735
#endif /* POLARSSL_ECP_DP_SECP192R1_ENABLED */

#if defined(POLARSSL_ECP_DP_SECP224R1_ENABLED)
        case POLARSSL_ECP_DP_SECP224R1:
736
            NIST_MODP( p224 );
737
            return( LOAD_GROUP( secp224r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
738 739 740 741
#endif /* POLARSSL_ECP_DP_SECP224R1_ENABLED */

#if defined(POLARSSL_ECP_DP_SECP256R1_ENABLED)
        case POLARSSL_ECP_DP_SECP256R1:
742
            NIST_MODP( p256 );
743
            return( LOAD_GROUP( secp256r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
744 745 746 747
#endif /* POLARSSL_ECP_DP_SECP256R1_ENABLED */

#if defined(POLARSSL_ECP_DP_SECP384R1_ENABLED)
        case POLARSSL_ECP_DP_SECP384R1:
748
            NIST_MODP( p384 );
749
            return( LOAD_GROUP( secp384r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
750 751 752 753
#endif /* POLARSSL_ECP_DP_SECP384R1_ENABLED */

#if defined(POLARSSL_ECP_DP_SECP521R1_ENABLED)
        case POLARSSL_ECP_DP_SECP521R1:
754
            NIST_MODP( p521 );
755
            return( LOAD_GROUP( secp521r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
756 757
#endif /* POLARSSL_ECP_DP_SECP521R1_ENABLED */

758 759
#if defined(POLARSSL_ECP_DP_SECP192K1_ENABLED)
        case POLARSSL_ECP_DP_SECP192K1:
760
            grp->modp = ecp_mod_p192k1;
761 762 763
            return( LOAD_GROUP_A( secp192k1 ) );
#endif /* POLARSSL_ECP_DP_SECP192K1_ENABLED */

764 765
#if defined(POLARSSL_ECP_DP_SECP224K1_ENABLED)
        case POLARSSL_ECP_DP_SECP224K1:
766
            grp->modp = ecp_mod_p224k1;
767 768 769
            return( LOAD_GROUP_A( secp224k1 ) );
#endif /* POLARSSL_ECP_DP_SECP224K1_ENABLED */

770 771
#if defined(POLARSSL_ECP_DP_SECP256K1_ENABLED)
        case POLARSSL_ECP_DP_SECP256K1:
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
772
            grp->modp = ecp_mod_p256k1;
773 774 775
            return( LOAD_GROUP_A( secp256k1 ) );
#endif /* POLARSSL_ECP_DP_SECP256K1_ENABLED */

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
776 777
#if defined(POLARSSL_ECP_DP_BP256R1_ENABLED)
        case POLARSSL_ECP_DP_BP256R1:
778
            return( LOAD_GROUP_A( brainpoolP256r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
779 780 781 782
#endif /* POLARSSL_ECP_DP_BP256R1_ENABLED */

#if defined(POLARSSL_ECP_DP_BP384R1_ENABLED)
        case POLARSSL_ECP_DP_BP384R1:
783
            return( LOAD_GROUP_A( brainpoolP384r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
784 785 786 787
#endif /* POLARSSL_ECP_DP_BP384R1_ENABLED */

#if defined(POLARSSL_ECP_DP_BP512R1_ENABLED)
        case POLARSSL_ECP_DP_BP512R1:
788
            return( LOAD_GROUP_A( brainpoolP512r1 ) );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
789 790
#endif /* POLARSSL_ECP_DP_BP512R1_ENABLED */

791 792
#if defined(POLARSSL_ECP_DP_M255_ENABLED)
        case POLARSSL_ECP_DP_M255:
793
            grp->modp = ecp_mod_p255;
794 795 796
            return( ecp_use_curve25519( grp ) );
#endif /* POLARSSL_ECP_DP_M255_ENABLED */

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859
        default:
            ecp_group_free( grp );
            return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE );
    }
}

#if defined(POLARSSL_ECP_NIST_OPTIM)
/*
 * Fast reduction modulo the primes used by the NIST curves.
 *
 * These functions are critical for speed, but not needed for correct
 * operations. So, we make the choice to heavily rely on the internals of our
 * bignum library, which creates a tight coupling between these functions and
 * our MPI implementation.  However, the coupling between the ECP module and
 * MPI remains loose, since these functions can be deactivated at will.
 */

#if defined(POLARSSL_ECP_DP_SECP192R1_ENABLED)
/*
 * Compared to the way things are presented in FIPS 186-3 D.2,
 * we proceed in columns, from right (least significant chunk) to left,
 * adding chunks to N in place, and keeping a carry for the next chunk.
 * This avoids moving things around in memory, and uselessly adding zeros,
 * compared to the more straightforward, line-oriented approach.
 *
 * For this prime we need to handle data in chunks of 64 bits.
 * Since this is always a multiple of our basic t_uint, we can
 * use a t_uint * to designate such a chunk, and small loops to handle it.
 */

/* Add 64-bit chunks (dst += src) and update carry */
static inline void add64( t_uint *dst, t_uint *src, t_uint *carry )
{
    unsigned char i;
    t_uint c = 0;
    for( i = 0; i < 8 / sizeof( t_uint ); i++, dst++, src++ )
    {
        *dst += c;      c  = ( *dst < c );
        *dst += *src;   c += ( *dst < *src );
    }
    *carry += c;
}

/* Add carry to a 64-bit chunk and update carry */
static inline void carry64( t_uint *dst, t_uint *carry )
{
    unsigned char i;
    for( i = 0; i < 8 / sizeof( t_uint ); i++, dst++ )
    {
        *dst += *carry;
        *carry  = ( *dst < *carry );
    }
}

#define WIDTH       8 / sizeof( t_uint )
#define A( i )      N->p + i * WIDTH
#define ADD( i )    add64( p, A( i ), &c )
#define NEXT        p += WIDTH; carry64( p, &c )
#define LAST        p += WIDTH; *p = c; while( ++p < end ) *p = 0

/*
 * Fast quasi-reduction modulo p192 (FIPS 186-3 D.2.1)
 */
860
static int ecp_mod_p192( mpi *N )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030
{
    int ret;
    t_uint c = 0;
    t_uint *p, *end;

    /* Make sure we have enough blocks so that A(5) is legal */
    MPI_CHK( mpi_grow( N, 6 * WIDTH ) );

    p = N->p;
    end = p + N->n;

    ADD( 3 ); ADD( 5 );             NEXT; // A0 += A3 + A5
    ADD( 3 ); ADD( 4 ); ADD( 5 );   NEXT; // A1 += A3 + A4 + A5
    ADD( 4 ); ADD( 5 );             LAST; // A2 += A4 + A5

cleanup:
    return( ret );
}

#undef WIDTH
#undef A
#undef ADD
#undef NEXT
#undef LAST
#endif /* POLARSSL_ECP_DP_SECP192R1_ENABLED */

#if defined(POLARSSL_ECP_DP_SECP224R1_ENABLED) ||   \
    defined(POLARSSL_ECP_DP_SECP256R1_ENABLED) ||   \
    defined(POLARSSL_ECP_DP_SECP384R1_ENABLED)
/*
 * The reader is advised to first understand ecp_mod_p192() since the same
 * general structure is used here, but with additional complications:
 * (1) chunks of 32 bits, and (2) subtractions.
 */

/*
 * For these primes, we need to handle data in chunks of 32 bits.
 * This makes it more complicated if we use 64 bits limbs in MPI,
 * which prevents us from using a uniform access method as for p192.
 *
 * So, we define a mini abstraction layer to access 32 bit chunks,
 * load them in 'cur' for work, and store them back from 'cur' when done.
 *
 * While at it, also define the size of N in terms of 32-bit chunks.
 */
#define LOAD32      cur = A( i );

#if defined(POLARSSL_HAVE_INT8)     /* 8 bit */

#define MAX32       N->n / 4
#define A( j )      (uint32_t)( N->p[4*j+0]       ) |  \
                              ( N->p[4*j+1] << 8  ) |  \
                              ( N->p[4*j+2] << 16 ) |  \
                              ( N->p[4*j+3] << 24 )
#define STORE32     N->p[4*i+0] = (t_uint)( cur       );   \
                    N->p[4*i+1] = (t_uint)( cur >> 8  );   \
                    N->p[4*i+2] = (t_uint)( cur >> 16 );   \
                    N->p[4*i+3] = (t_uint)( cur >> 24 );

#elif defined(POLARSSL_HAVE_INT16)  /* 16 bit */

#define MAX32       N->n / 2
#define A( j )      (uint32_t)( N->p[2*j] ) | ( N->p[2*j+1] << 16 )
#define STORE32     N->p[2*i+0] = (t_uint)( cur       );  \
                    N->p[2*i+1] = (t_uint)( cur >> 16 );

#elif defined(POLARSSL_HAVE_INT32)  /* 32 bit */

#define MAX32       N->n
#define A( j )      N->p[j]
#define STORE32     N->p[i] = cur;

#else                               /* 64-bit */

#define MAX32       N->n * 2
#define A( j ) j % 2 ? (uint32_t)( N->p[j/2] >> 32 ) : (uint32_t)( N->p[j/2] )
#define STORE32                                   \
    if( i % 2 ) {                                 \
        N->p[i/2] &= 0x00000000FFFFFFFF;          \
        N->p[i/2] |= ((t_uint) cur) << 32;        \
    } else {                                      \
        N->p[i/2] &= 0xFFFFFFFF00000000;          \
        N->p[i/2] |= (t_uint) cur;                \
    }

#endif /* sizeof( t_uint ) */

/*
 * Helpers for addition and subtraction of chunks, with signed carry.
 */
static