/* Check if y^2 = x^3 - 3x + b */
static int
ecc_valid_p (struct ecc_point *pub)
{
mpz_t t, x, y;
mpz_t lhs, rhs;
int res;
mp_size_t size;
size = pub->ecc->size;
/* First check range */
if (mpn_cmp (pub->p, pub->ecc->p, size) >= 0
|| mpn_cmp (pub->p + size, pub->ecc->p, size) >= 0)
return 0;
mpz_init (lhs);
mpz_init (rhs);
mpz_roinit_n (x, pub->p, size);
mpz_roinit_n (y, pub->p + size, size);
mpz_mul (lhs, y, y);
mpz_mul (rhs, x, x);
mpz_sub_ui (rhs, rhs, 3);
mpz_mul (rhs, rhs, x);
mpz_add (rhs, rhs, mpz_roinit_n (t, pub->ecc->b, size));
res = mpz_congruent_p (lhs, rhs, mpz_roinit_n (t, pub->ecc->p, size));
mpz_clear (lhs);
mpz_clear (rhs);
return res;
}
static void
ref_mod (mp_limb_t *rp, const mp_limb_t *ap, const mp_limb_t *mp, mp_size_t mn)
{
mpz_t r, a, m;
mpz_init (r);
mpz_mod (r, mpz_roinit_n (a, ap, 2*mn), mpz_roinit_n (m, mp, mn));
mpz_limbs_copy (rp, r, mn);
mpz_clear (r);
}
/* Check if y^2 = x^3 - 3x + b */
static int
ecc_valid_p (struct ecc_point *pub)
{
mpz_t t, x, y;
mpz_t lhs, rhs;
int res;
mp_size_t size;
size = pub->ecc->p.size;
/* First check range */
if (mpn_cmp (pub->p, pub->ecc->p.m, size) >= 0
|| mpn_cmp (pub->p + size, pub->ecc->p.m, size) >= 0)
return 0;
mpz_init (lhs);
mpz_init (rhs);
mpz_roinit_n (x, pub->p, size);
mpz_roinit_n (y, pub->p + size, size);
mpz_mul (lhs, y, y);
if (pub->ecc->p.bit_size == 255)
{
/* Check that
121666 (1 + x^2 - y^2) = 121665 x^2 y^2 */
mpz_t x2;
mpz_init (x2);
mpz_mul (x2, x, x); /* x^2 */
mpz_mul (rhs, x2, lhs); /* x^2 y^2 */
mpz_sub (lhs, x2, lhs); /* x^2 - y^2 */
mpz_add_ui (lhs, lhs, 1); /* 1 + x^2 - y^2 */
mpz_mul_ui (lhs, lhs, 121666);
mpz_mul_ui (rhs, rhs, 121665);
mpz_clear (x2);
}
else
{
/* Check y^2 = x^3 - 3 x + b */
mpz_mul (rhs, x, x);
mpz_sub_ui (rhs, rhs, 3);
mpz_mul (rhs, rhs, x);
mpz_add (rhs, rhs, mpz_roinit_n (t, pub->ecc->b, size));
}
res = mpz_congruent_p (lhs, rhs, mpz_roinit_n (t, pub->ecc->p.m, size));
mpz_clear (lhs);
mpz_clear (rhs);
return res;
}
/* Key comes in form .... M_2 M_1 K_0,
unmask is K_i = K_i-1 * M_i mod Q */
int
gostdsa_unmask_key (const struct ecc_curve *ecc,
mpz_t key)
{
unsigned bits = ecc_bit_size (ecc);
unsigned keybits = mpz_sizeinbase (key, 2);
mpz_t unmasked, temp, temp2, q;
if (keybits <= bits)
return 0;
mpz_init (unmasked);
mpz_init (temp);
mpz_init (temp2);
mpz_roinit_n (q, ecc->q.m, ecc->q.size);
mpz_tdiv_r_2exp (unmasked, key, bits);
mpz_tdiv_q_2exp (key, key, bits);
keybits -= bits;
while (keybits > bits)
{
mpz_tdiv_r_2exp (temp2, key, bits);
mpz_tdiv_q_2exp (key, key, bits);
keybits -= bits;
mpz_mul (temp, unmasked, temp2);
mpz_mod (unmasked, temp, q);
}
mpz_mul (temp, unmasked, key);
mpz_mod (key, temp, q);
mpz_clear (temp2);
mpz_clear (temp);
mpz_clear (unmasked);
return 0;
}
static void
test_modulo (gmp_randstate_t rands, const struct ecc_modulo *m)
{
mpz_t u;
mpz_t v;
mpz_t p;
mpz_t r;
mpz_t t;
unsigned z, i;
mp_limb_t *up;
mp_limb_t *vp;
mp_limb_t *rp;
mp_limb_t *scratch;
mpz_init (u);
mpz_init (v);
mpz_init (t);
mpz_roinit_n (p, m->m, m->size);
up = xalloc_limbs (m->size);
vp = xalloc_limbs (m->size);
rp = xalloc_limbs (2*m->size);
scratch = xalloc_limbs (m->sqrt_itch);
/* Find a non-square */
for (z = 2; mpz_ui_kronecker (z, p) != -1; z++)
;
if (verbose)
fprintf(stderr, "Non square: %d\n", z);
for (i = 0; i < COUNT; i++)
{
if (i & 1)
{
mpz_rrandomb (u, rands, m->bit_size);
mpz_rrandomb (v, rands, m->bit_size);
}
else
{
mpz_urandomb (u, rands, m->bit_size);
mpz_urandomb (v, rands, m->bit_size);
}
mpz_limbs_copy (up, u, m->size);
mpz_limbs_copy (vp, v, m->size);
if (!m->sqrt (m, rp, up, vp, scratch))
{
mpz_mul_ui (u, u, z);
mpz_mod (u, u, p);
mpz_limbs_copy (up, u, m->size);
if (!m->sqrt (m, rp, up, vp, scratch))
{
fprintf (stderr, "m->sqrt returned failure, bit_size = %d\n"
"u = 0x",
m->bit_size);
mpz_out_str (stderr, 16, u);
fprintf (stderr, "\nv = 0x");
mpz_out_str (stderr, 16, v);
fprintf (stderr, "\n");
abort ();
}
}
/* Check that r^2 v = u */
mpz_roinit_n (r, rp, m->size);
mpz_mul (t, r, r);
mpz_mul (t, t, v);
if (!mpz_congruent_p (t, u, p))
{
fprintf (stderr, "m->sqrt gave incorrect result, bit_size = %d\n"
"u = 0x",
m->bit_size);
mpz_out_str (stderr, 16, u);
fprintf (stderr, "\nv = 0x");
mpz_out_str (stderr, 16, v);
fprintf (stderr, "\nr = 0x");
mpz_out_str (stderr, 16, r);
fprintf (stderr, "\n");
abort ();
}
}
mpz_clear (u);
mpz_clear (v);
mpz_clear (t);
free (up);
free (vp);
free (rp);
free (scratch);
}