|
380
|
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis |
|
|
2 * |
|
|
3 * LibTomCrypt is a library that provides various cryptographic |
|
|
4 * algorithms in a highly modular and flexible manner. |
|
|
5 * |
|
|
6 * The library is free for all purposes without any express |
|
|
7 * guarantee it works. |
|
|
8 * |
|
|
9 * Tom St Denis, [email protected], http://libtomcrypt.com |
|
|
10 */ |
|
|
11 |
|
|
12 /* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b |
|
|
13 * |
|
|
14 * All curves taken from NIST recommendation paper of July 1999 |
|
|
15 * Available at http://csrc.nist.gov/cryptval/dss.htm |
|
|
16 */ |
|
|
17 #include "tomcrypt.h" |
|
|
18 |
|
|
19 /** |
|
|
20 @file ltc_ecc_projective_add_point.c |
|
|
21 ECC Crypto, Tom St Denis |
|
|
22 */ |
|
|
23 |
|
|
24 #if defined(MECC) && (!defined(MECC_ACCEL) || defined(LTM_DESC)) |
|
|
25 |
|
|
26 /** |
|
|
27 Add two ECC points |
|
|
28 @param P The point to add |
|
|
29 @param Q The point to add |
|
|
30 @param R [out] The destination of the double |
|
|
31 @param modulus The modulus of the field the ECC curve is in |
|
|
32 @param mp The "b" value from montgomery_setup() |
|
|
33 @return CRYPT_OK on success |
|
|
34 */ |
|
|
35 int ltc_ecc_projective_add_point(ecc_point *P, ecc_point *Q, ecc_point *R, void *modulus, void *mp) |
|
|
36 { |
|
|
37 void *t1, *t2, *x, *y, *z; |
|
|
38 int err; |
|
|
39 |
|
|
40 LTC_ARGCHK(P != NULL); |
|
|
41 LTC_ARGCHK(Q != NULL); |
|
|
42 LTC_ARGCHK(R != NULL); |
|
|
43 LTC_ARGCHK(modulus != NULL); |
|
|
44 LTC_ARGCHK(mp != NULL); |
|
|
45 |
|
|
46 if ((err = mp_init_multi(&t1, &t2, &x, &y, &z, NULL)) != CRYPT_OK) { |
|
|
47 return err; |
|
|
48 } |
|
|
49 |
|
|
50 /* should we dbl instead? */ |
|
|
51 if ((err = mp_sub(modulus, Q->y, t1)) != CRYPT_OK) { goto done; } |
|
|
52 |
|
|
53 if ( (mp_cmp(P->x, Q->x) == LTC_MP_EQ) && |
|
|
54 (Q->z != NULL && mp_cmp(P->z, Q->z) == LTC_MP_EQ) && |
|
|
55 (mp_cmp(P->y, Q->y) == LTC_MP_EQ || mp_cmp(P->y, t1) == LTC_MP_EQ)) { |
|
|
56 mp_clear_multi(t1, t2, x, y, z, NULL); |
|
|
57 return ltc_ecc_projective_dbl_point(P, R, modulus, mp); |
|
|
58 } |
|
|
59 |
|
|
60 if ((err = mp_copy(P->x, x)) != CRYPT_OK) { goto done; } |
|
|
61 if ((err = mp_copy(P->y, y)) != CRYPT_OK) { goto done; } |
|
|
62 if ((err = mp_copy(P->z, z)) != CRYPT_OK) { goto done; } |
|
|
63 |
|
|
64 /* if Z is one then these are no-operations */ |
|
|
65 if (Q->z != NULL) { |
|
|
66 /* T1 = Z' * Z' */ |
|
|
67 if ((err = mp_sqr(Q->z, t1)) != CRYPT_OK) { goto done; } |
|
|
68 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
69 /* X = X * T1 */ |
|
|
70 if ((err = mp_mul(t1, x, x)) != CRYPT_OK) { goto done; } |
|
|
71 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
72 /* T1 = Z' * T1 */ |
|
|
73 if ((err = mp_mul(Q->z, t1, t1)) != CRYPT_OK) { goto done; } |
|
|
74 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
75 /* Y = Y * T1 */ |
|
|
76 if ((err = mp_mul(t1, y, y)) != CRYPT_OK) { goto done; } |
|
|
77 if ((err = mp_montgomery_reduce(y, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
78 } |
|
|
79 |
|
|
80 /* T1 = Z*Z */ |
|
|
81 if ((err = mp_sqr(z, t1)) != CRYPT_OK) { goto done; } |
|
|
82 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
83 /* T2 = X' * T1 */ |
|
|
84 if ((err = mp_mul(Q->x, t1, t2)) != CRYPT_OK) { goto done; } |
|
|
85 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
86 /* T1 = Z * T1 */ |
|
|
87 if ((err = mp_mul(z, t1, t1)) != CRYPT_OK) { goto done; } |
|
|
88 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
89 /* T1 = Y' * T1 */ |
|
|
90 if ((err = mp_mul(Q->y, t1, t1)) != CRYPT_OK) { goto done; } |
|
|
91 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
92 |
|
|
93 /* Y = Y - T1 */ |
|
|
94 if ((err = mp_sub(y, t1, y)) != CRYPT_OK) { goto done; } |
|
|
95 if (mp_cmp_d(y, 0) == LTC_MP_LT) { |
|
|
96 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; } |
|
|
97 } |
|
|
98 /* T1 = 2T1 */ |
|
|
99 if ((err = mp_add(t1, t1, t1)) != CRYPT_OK) { goto done; } |
|
|
100 if (mp_cmp(t1, modulus) != LTC_MP_LT) { |
|
|
101 if ((err = mp_sub(t1, modulus, t1)) != CRYPT_OK) { goto done; } |
|
|
102 } |
|
|
103 /* T1 = Y + T1 */ |
|
|
104 if ((err = mp_add(t1, y, t1)) != CRYPT_OK) { goto done; } |
|
|
105 if (mp_cmp(t1, modulus) != LTC_MP_LT) { |
|
|
106 if ((err = mp_sub(t1, modulus, t1)) != CRYPT_OK) { goto done; } |
|
|
107 } |
|
|
108 /* X = X - T2 */ |
|
|
109 if ((err = mp_sub(x, t2, x)) != CRYPT_OK) { goto done; } |
|
|
110 if (mp_cmp_d(x, 0) == LTC_MP_LT) { |
|
|
111 if ((err = mp_add(x, modulus, x)) != CRYPT_OK) { goto done; } |
|
|
112 } |
|
|
113 /* T2 = 2T2 */ |
|
|
114 if ((err = mp_add(t2, t2, t2)) != CRYPT_OK) { goto done; } |
|
|
115 if (mp_cmp(t2, modulus) != LTC_MP_LT) { |
|
|
116 if ((err = mp_sub(t2, modulus, t2)) != CRYPT_OK) { goto done; } |
|
|
117 } |
|
|
118 /* T2 = X + T2 */ |
|
|
119 if ((err = mp_add(t2, x, t2)) != CRYPT_OK) { goto done; } |
|
|
120 if (mp_cmp(t2, modulus) != LTC_MP_LT) { |
|
|
121 if ((err = mp_sub(t2, modulus, t2)) != CRYPT_OK) { goto done; } |
|
|
122 } |
|
|
123 |
|
|
124 /* if Z' != 1 */ |
|
|
125 if (Q->z != NULL) { |
|
|
126 /* Z = Z * Z' */ |
|
|
127 if ((err = mp_mul(z, Q->z, z)) != CRYPT_OK) { goto done; } |
|
|
128 if ((err = mp_montgomery_reduce(z, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
129 } |
|
|
130 |
|
|
131 /* Z = Z * X */ |
|
|
132 if ((err = mp_mul(z, x, z)) != CRYPT_OK) { goto done; } |
|
|
133 if ((err = mp_montgomery_reduce(z, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
134 |
|
|
135 /* T1 = T1 * X */ |
|
|
136 if ((err = mp_mul(t1, x, t1)) != CRYPT_OK) { goto done; } |
|
|
137 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
138 /* X = X * X */ |
|
|
139 if ((err = mp_sqr(x, x)) != CRYPT_OK) { goto done; } |
|
|
140 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
141 /* T2 = T2 * x */ |
|
|
142 if ((err = mp_mul(t2, x, t2)) != CRYPT_OK) { goto done; } |
|
|
143 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
144 /* T1 = T1 * X */ |
|
|
145 if ((err = mp_mul(t1, x, t1)) != CRYPT_OK) { goto done; } |
|
|
146 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
147 |
|
|
148 /* X = Y*Y */ |
|
|
149 if ((err = mp_sqr(y, x)) != CRYPT_OK) { goto done; } |
|
|
150 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
151 /* X = X - T2 */ |
|
|
152 if ((err = mp_sub(x, t2, x)) != CRYPT_OK) { goto done; } |
|
|
153 if (mp_cmp_d(x, 0) == LTC_MP_LT) { |
|
|
154 if ((err = mp_add(x, modulus, x)) != CRYPT_OK) { goto done; } |
|
|
155 } |
|
|
156 |
|
|
157 /* T2 = T2 - X */ |
|
|
158 if ((err = mp_sub(t2, x, t2)) != CRYPT_OK) { goto done; } |
|
|
159 if (mp_cmp_d(t2, 0) == LTC_MP_LT) { |
|
|
160 if ((err = mp_add(t2, modulus, t2)) != CRYPT_OK) { goto done; } |
|
|
161 } |
|
|
162 /* T2 = T2 - X */ |
|
|
163 if ((err = mp_sub(t2, x, t2)) != CRYPT_OK) { goto done; } |
|
|
164 if (mp_cmp_d(t2, 0) == LTC_MP_LT) { |
|
|
165 if ((err = mp_add(t2, modulus, t2)) != CRYPT_OK) { goto done; } |
|
|
166 } |
|
|
167 /* T2 = T2 * Y */ |
|
|
168 if ((err = mp_mul(t2, y, t2)) != CRYPT_OK) { goto done; } |
|
|
169 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; } |
|
|
170 /* Y = T2 - T1 */ |
|
|
171 if ((err = mp_sub(t2, t1, y)) != CRYPT_OK) { goto done; } |
|
|
172 if (mp_cmp_d(y, 0) == LTC_MP_LT) { |
|
|
173 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; } |
|
|
174 } |
|
|
175 /* Y = Y/2 */ |
|
|
176 if (mp_isodd(y)) { |
|
|
177 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; } |
|
|
178 } |
|
|
179 if ((err = mp_div_2(y, y)) != CRYPT_OK) { goto done; } |
|
|
180 |
|
|
181 if ((err = mp_copy(x, R->x)) != CRYPT_OK) { goto done; } |
|
|
182 if ((err = mp_copy(y, R->y)) != CRYPT_OK) { goto done; } |
|
|
183 if ((err = mp_copy(z, R->z)) != CRYPT_OK) { goto done; } |
|
|
184 |
|
|
185 err = CRYPT_OK; |
|
|
186 done: |
|
|
187 mp_clear_multi(t1, t2, x, y, z, NULL); |
|
|
188 return err; |
|
|
189 } |
|
|
190 |
|
|
191 #endif |
|
|
192 |
|
|
193 /* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c,v $ */ |
|
|
194 /* $Revision: 1.13 $ */ |
|
|
195 /* $Date: 2006/12/04 05:07:59 $ */ |
|
|
196 |
