1/**
2 * \file ecp_internal_alt.h
3 *
4 * \brief Function declarations for alternative implementation of elliptic curve
5 * point arithmetic.
6 */
7/*
8 *  Copyright The Mbed TLS Contributors
9 *  SPDX-License-Identifier: Apache-2.0
10 *
11 *  Licensed under the Apache License, Version 2.0 (the "License"); you may
12 *  not use this file except in compliance with the License.
13 *  You may obtain a copy of the License at
14 *
15 *  http://www.apache.org/licenses/LICENSE-2.0
16 *
17 *  Unless required by applicable law or agreed to in writing, software
18 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
19 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 *  See the License for the specific language governing permissions and
21 *  limitations under the License.
22 */
23
24/*
25 * References:
26 *
27 * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records.
28 *     <http://cr.yp.to/ecdh/curve25519-20060209.pdf>
29 *
30 * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
31 *     for elliptic curve cryptosystems. In : Cryptographic Hardware and
32 *     Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
33 *     <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
34 *
35 * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
36 *     render ECC resistant against Side Channel Attacks. IACR Cryptology
37 *     ePrint Archive, 2004, vol. 2004, p. 342.
38 *     <http://eprint.iacr.org/2004/342.pdf>
39 *
40 * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters.
41 *     <http://www.secg.org/sec2-v2.pdf>
42 *
43 * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic
44 *     Curve Cryptography.
45 *
46 * [6] Digital Signature Standard (DSS), FIPS 186-4.
47 *     <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf>
48 *
49 * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer
50 *     Security (TLS), RFC 4492.
51 *     <https://tools.ietf.org/search/rfc4492>
52 *
53 * [8] <http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html>
54 *
55 * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory.
56 *     Springer Science & Business Media, 1 Aug 2000
57 */
58
59#ifndef MBEDTLS_ECP_INTERNAL_H
60#define MBEDTLS_ECP_INTERNAL_H
61
62#include "mbedtls/build_info.h"
63
64#if defined(MBEDTLS_ECP_INTERNAL_ALT)
65
66/**
67 * \brief           Indicate if the Elliptic Curve Point module extension can
68 *                  handle the group.
69 *
70 * \param grp       The pointer to the elliptic curve group that will be the
71 *                  basis of the cryptographic computations.
72 *
73 * \return          Non-zero if successful.
74 */
75unsigned char mbedtls_internal_ecp_grp_capable(const mbedtls_ecp_group *grp);
76
77/**
78 * \brief           Initialise the Elliptic Curve Point module extension.
79 *
80 *                  If mbedtls_internal_ecp_grp_capable returns true for a
81 *                  group, this function has to be able to initialise the
82 *                  module for it.
83 *
84 *                  This module can be a driver to a crypto hardware
85 *                  accelerator, for which this could be an initialise function.
86 *
87 * \param grp       The pointer to the group the module needs to be
88 *                  initialised for.
89 *
90 * \return          0 if successful.
91 */
92int mbedtls_internal_ecp_init(const mbedtls_ecp_group *grp);
93
94/**
95 * \brief           Frees and deallocates the Elliptic Curve Point module
96 *                  extension.
97 *
98 * \param grp       The pointer to the group the module was initialised for.
99 */
100void mbedtls_internal_ecp_free(const mbedtls_ecp_group *grp);
101
102#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
103
104#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
105/**
106 * \brief           Randomize jacobian coordinates:
107 *                  (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l.
108 *
109 * \param grp       Pointer to the group representing the curve.
110 *
111 * \param pt        The point on the curve to be randomised, given with Jacobian
112 *                  coordinates.
113 *
114 * \param f_rng     A function pointer to the random number generator.
115 *
116 * \param p_rng     A pointer to the random number generator state.
117 *
118 * \return          0 if successful.
119 */
120int mbedtls_internal_ecp_randomize_jac(const mbedtls_ecp_group *grp,
121                                       mbedtls_ecp_point *pt, int (*f_rng)(void *,
122                                                                           unsigned char *,
123                                                                           size_t),
124                                       void *p_rng);
125#endif
126
127#if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
128/**
129 * \brief           Addition: R = P + Q, mixed affine-Jacobian coordinates.
130 *
131 *                  The coordinates of Q must be normalized (= affine),
132 *                  but those of P don't need to. R is not normalized.
133 *
134 *                  This function is used only as a subrutine of
135 *                  ecp_mul_comb().
136 *
137 *                  Special cases: (1) P or Q is zero, (2) R is zero,
138 *                      (3) P == Q.
139 *                  None of these cases can happen as intermediate step in
140 *                  ecp_mul_comb():
141 *                      - at each step, P, Q and R are multiples of the base
142 *                      point, the factor being less than its order, so none of
143 *                      them is zero;
144 *                      - Q is an odd multiple of the base point, P an even
145 *                      multiple, due to the choice of precomputed points in the
146 *                      modified comb method.
147 *                  So branches for these cases do not leak secret information.
148 *
149 *                  We accept Q->Z being unset (saving memory in tables) as
150 *                  meaning 1.
151 *
152 *                  Cost in field operations if done by [5] 3.22:
153 *                      1A := 8M + 3S
154 *
155 * \param grp       Pointer to the group representing the curve.
156 *
157 * \param R         Pointer to a point structure to hold the result.
158 *
159 * \param P         Pointer to the first summand, given with Jacobian
160 *                  coordinates
161 *
162 * \param Q         Pointer to the second summand, given with affine
163 *                  coordinates.
164 *
165 * \return          0 if successful.
166 */
167int mbedtls_internal_ecp_add_mixed(const mbedtls_ecp_group *grp,
168                                   mbedtls_ecp_point *R, const mbedtls_ecp_point *P,
169                                   const mbedtls_ecp_point *Q);
170#endif
171
172/**
173 * \brief           Point doubling R = 2 P, Jacobian coordinates.
174 *
175 *                  Cost:   1D := 3M + 4S    (A ==  0)
176 *                          4M + 4S          (A == -3)
177 *                          3M + 6S + 1a     otherwise
178 *                  when the implementation is based on the "dbl-1998-cmo-2"
179 *                  doubling formulas in [8] and standard optimizations are
180 *                  applied when curve parameter A is one of { 0, -3 }.
181 *
182 * \param grp       Pointer to the group representing the curve.
183 *
184 * \param R         Pointer to a point structure to hold the result.
185 *
186 * \param P         Pointer to the point that has to be doubled, given with
187 *                  Jacobian coordinates.
188 *
189 * \return          0 if successful.
190 */
191#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
192int mbedtls_internal_ecp_double_jac(const mbedtls_ecp_group *grp,
193                                    mbedtls_ecp_point *R, const mbedtls_ecp_point *P);
194#endif
195
196/**
197 * \brief           Normalize jacobian coordinates of an array of (pointers to)
198 *                  points.
199 *
200 *                  Using Montgomery's trick to perform only one inversion mod P
201 *                  the cost is:
202 *                      1N(t) := 1I + (6t - 3)M + 1S
203 *                  (See for example Algorithm 10.3.4. in [9])
204 *
205 *                  This function is used only as a subrutine of
206 *                  ecp_mul_comb().
207 *
208 *                  Warning: fails (returning an error) if one of the points is
209 *                  zero!
210 *                  This should never happen, see choice of w in ecp_mul_comb().
211 *
212 * \param grp       Pointer to the group representing the curve.
213 *
214 * \param T         Array of pointers to the points to normalise.
215 *
216 * \param t_len     Number of elements in the array.
217 *
218 * \return          0 if successful,
219 *                      an error if one of the points is zero.
220 */
221#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
222int mbedtls_internal_ecp_normalize_jac_many(const mbedtls_ecp_group *grp,
223                                            mbedtls_ecp_point *T[], size_t t_len);
224#endif
225
226/**
227 * \brief           Normalize jacobian coordinates so that Z == 0 || Z == 1.
228 *
229 *                  Cost in field operations if done by [5] 3.2.1:
230 *                      1N := 1I + 3M + 1S
231 *
232 * \param grp       Pointer to the group representing the curve.
233 *
234 * \param pt        pointer to the point to be normalised. This is an
235 *                  input/output parameter.
236 *
237 * \return          0 if successful.
238 */
239#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
240int mbedtls_internal_ecp_normalize_jac(const mbedtls_ecp_group *grp,
241                                       mbedtls_ecp_point *pt);
242#endif
243
244#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
245
246#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
247
248#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
249int mbedtls_internal_ecp_double_add_mxz(const mbedtls_ecp_group *grp,
250                                        mbedtls_ecp_point *R,
251                                        mbedtls_ecp_point *S,
252                                        const mbedtls_ecp_point *P,
253                                        const mbedtls_ecp_point *Q,
254                                        const mbedtls_mpi *d);
255#endif
256
257/**
258 * \brief           Randomize projective x/z coordinates:
259 *                      (X, Z) -> (l X, l Z) for random l
260 *
261 * \param grp       pointer to the group representing the curve
262 *
263 * \param P         the point on the curve to be randomised given with
264 *                  projective coordinates. This is an input/output parameter.
265 *
266 * \param f_rng     a function pointer to the random number generator
267 *
268 * \param p_rng     a pointer to the random number generator state
269 *
270 * \return          0 if successful
271 */
272#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
273int mbedtls_internal_ecp_randomize_mxz(const mbedtls_ecp_group *grp,
274                                       mbedtls_ecp_point *P, int (*f_rng)(void *,
275                                                                          unsigned char *,
276                                                                          size_t),
277                                       void *p_rng);
278#endif
279
280/**
281 * \brief           Normalize Montgomery x/z coordinates: X = X/Z, Z = 1.
282 *
283 * \param grp       pointer to the group representing the curve
284 *
285 * \param P         pointer to the point to be normalised. This is an
286 *                  input/output parameter.
287 *
288 * \return          0 if successful
289 */
290#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
291int mbedtls_internal_ecp_normalize_mxz(const mbedtls_ecp_group *grp,
292                                       mbedtls_ecp_point *P);
293#endif
294
295#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
296
297#endif /* MBEDTLS_ECP_INTERNAL_ALT */
298
299#endif /* ecp_internal_alt.h */
300