int fp2_srt(fp2_t c, fp2_t a) {
int r = 0;
fp_t t1;
fp_t t2;
fp_t t3;
fp_null(t1);
fp_null(t2);
fp_null(t3);
TRY {
fp_new(t1);
fp_new(t2);
fp_new(t3);
/* t1 = a[0]^2 - u^2 * a[1]^2 */
fp_sqr(t1, a[0]);
fp_sqr(t2, a[1]);
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_add(t1, t1, t2);
}
for (int i = 0; i <= fp_prime_get_qnr(); i++) {
fp_sub(t1, t1, t2);
}
fp_add(t1, t1, t2);
if (fp_srt(t2, t1)) {
/* t1 = (a_0 + sqrt(t1)) / 2 */
fp_add(t1, a[0], t2);
fp_set_dig(t3, 2);
fp_inv(t3, t3);
fp_mul(t1, t1, t3);
if (!fp_srt(t3, t1)) {
/* t1 = (a_0 - sqrt(t1)) / 2 */
fp_sub(t1, a[0], t2);
fp_set_dig(t3, 2);
fp_inv(t3, t3);
fp_mul(t1, t1, t3);
fp_srt(t3, t1);
}
/* c_0 = sqrt(t1) */
fp_copy(c[0], t3);
/* c_1 = a_1 / (2 * sqrt(t1)) */
fp_dbl(t3, t3);
fp_inv(t3, t3);
fp_mul(c[1], a[1], t3);
r = 1;
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t1);
fp_free(t2);
fp_free(t3);
}
return r;
}
void ep_rhs(fp_t rhs, const ep_t p) {
fp_t t0;
fp_t t1;
fp_null(t0);
fp_null(t1);
TRY {
fp_new(t0);
fp_new(t1);
/* t0 = x1^2. */
fp_sqr(t0, p->x);
/* t1 = x1^3. */
fp_mul(t1, t0, p->x);
/* t1 = x1^3 + a * x1 + b. */
switch (ep_curve_opt_a()) {
case OPT_ZERO:
break;
case OPT_ONE:
fp_add(t1, t1, p->x);
break;
#if FP_RDC != MONTY
case OPT_DIGIT:
fp_mul_dig(t0, p->x, ep_curve_get_a()[0]);
fp_add(t1, t1, t0);
break;
#endif
default:
fp_mul(t0, p->x, ep_curve_get_a());
fp_add(t1, t1, t0);
break;
}
switch (ep_curve_opt_b()) {
case OPT_ZERO:
break;
case OPT_ONE:
fp_add_dig(t1, t1, 1);
break;
#if FP_RDC != MONTY
case OPT_DIGIT:
fp_add_dig(t1, t1, ep_curve_get_b()[0]);
break;
#endif
default:
fp_add(t1, t1, ep_curve_get_b());
break;
}
fp_copy(rhs, t1);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(t0);
fp_free(t1);
}
}
/**
* Normalizes a point represented in projective coordinates.
*
* @param r - the result.
* @param p - the point to normalize.
*/
static void ep_norm_imp(ep_t r, const ep_t p, int inverted) {
if (!p->norm) {
fp_t t0, t1;
fp_null(t0);
fp_null(t1);
TRY {
fp_new(t0);
fp_new(t1);
if (inverted) {
fp_copy(t1, p->z);
} else {
fp_inv(t1, p->z);
}
fp_sqr(t0, t1);
fp_mul(r->x, p->x, t0);
fp_mul(t0, t0, t1);
fp_mul(r->y, p->y, t0);
fp_set_dig(r->z, 1);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
}
}
void fp2_sqr_basic(fp2_t c, fp2_t a) {
fp_t t0, t1, t2;
fp_null(t0);
fp_null(t1);
fp_null(t2);
TRY {
fp_new(t0);
fp_new(t1);
fp_new(t2);
/* t0 = (a_0 + a_1). */
fp_add(t0, a[0], a[1]);
/* t1 = (a_0 - a_1). */
fp_sub(t1, a[0], a[1]);
/* t1 = a_0 + u^2 * a_1. */
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_sub(t1, t1, a[1]);
}
for (int i = 0; i <= fp_prime_get_qnr(); i++) {
fp_add(t1, t1, a[1]);
}
if (fp_prime_get_qnr() == -1) {
/* t2 = 2 * a_0. */
fp_dbl(t2, a[0]);
/* c_1 = 2 * a_0 * a_1. */
fp_mul(c[1], t2, a[1]);
/* c_0 = a_0^2 + a_1^2 * u^2. */
fp_mul(c[0], t0, t1);
} else {
/* c_1 = a_0 * a_1. */
fp_mul(c[1], a[0], a[1]);
/* c_0 = a_0^2 + a_1^2 * u^2. */
fp_mul(c[0], t0, t1);
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_add(c[0], c[0], c[1]);
}
for (int i = 0; i <= fp_prime_get_qnr(); i++) {
fp_sub(c[0], c[0], c[1]);
}
/* c_1 = 2 * a_0 * a_1. */
fp_dbl(c[1], c[1]);
}
/* c = c_0 + c_1 * u. */
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
fp_free(t2);
}
}
void fp2_inv(fp2_t c, fp2_t a) {
fp_t t0, t1;
fp_null(t0);
fp_null(t1);
TRY {
fp_new(t0);
fp_new(t1);
/* t0 = a_0^2, t1 = a_1^2. */
fp_sqr(t0, a[0]);
fp_sqr(t1, a[1]);
/* t1 = 1/(a_0^2 + a_1^2). */
#ifndef FP_QNRES
if (fp_prime_get_qnr() != -1) {
if (fp_prime_get_qnr() == -2) {
fp_dbl(t1, t1);
fp_add(t0, t0, t1);
} else {
if (fp_prime_get_qnr() < 0) {
fp_mul_dig(t1, t1, -fp_prime_get_qnr());
fp_add(t0, t0, t1);
} else {
fp_mul_dig(t1, t1, fp_prime_get_qnr());
fp_sub(t0, t0, t1);
}
}
} else {
fp_add(t0, t0, t1);
}
#else
fp_add(t0, t0, t1);
#endif
fp_inv(t1, t0);
/* c_0 = a_0/(a_0^2 + a_1^2). */
fp_mul(c[0], a[0], t1);
/* c_1 = - a_1/(a_0^2 + a_1^2). */
fp_mul(c[1], a[1], t1);
fp_neg(c[1], c[1]);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
}
}
/**
* Normalizes a point represented in projective coordinates.
*
* @param r - the result.
* @param p - the point to normalize.
*/
void ed_norm(ed_t r, const ed_t p) {
if (ed_is_infty(p)) {
ed_set_infty(r);
return;
}
if (fp_cmp_dig(p->z, 1) == CMP_EQ) {
/* If the point is represented in affine coordinates, we just copy it. */
ed_copy(r, p);
} else {
fp_t z_inv;
fp_null(z_inv);
fp_new(z_inv);
fp_inv(z_inv, p->z);
fp_mul(r->x, p->x, z_inv);
fp_mul(r->y, p->y, z_inv);
#if ED_ADD == EXTND
fp_mul(r->t, p->t, z_inv);
#endif
fp_set_dig(r->z, 1);
fp_free(z_inv);
}
}
int fp2_upk(fp2_t c, fp2_t a) {
int result, b = fp_get_bit(a[1], 0);
fp_t t;
fp_null(t);
TRY {
fp_new(t);
/* a_0^2 + a_1^2 = 1, thus a_1^2 = 1 - a_0^2. */
fp_sqr(t, a[0]);
fp_sub_dig(t, t, 1);
fp_neg(t, t);
/* a1 = sqrt(a_0^2). */
result = fp_srt(t, t);
if (result) {
/* Verify if least significant bit of the result matches the
* compressed second coordinate. */
if (fp_get_bit(t, 0) != b) {
fp_neg(t, t);
}
fp_copy(c[0], a[0]);
fp_copy(c[1], t);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(t);
}
return result;
}
void ed_norm_sim(ed_t *r, const ed_t *t, int n) {
int i;
fp_t a[n];
for (i = 0; i < n; i++) {
fp_null(a[i]);
}
TRY {
for (i = 0; i < n; i++) {
fp_new(a[i]);
fp_copy(a[i], t[i]->z);
}
fp_inv_sim(a, (const fp_t *)a, n);
for (i = 0; i < n; i++) {
fp_mul(r[i]->x, t[i]->x, a[i]);
fp_mul(r[i]->y, t[i]->y, a[i]);
#if ED_ADD == EXTND
fp_mul(r[i]->t, t[i]->t, a[i]);
#endif
fp_set_dig(r[i]->z, 1);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
for (i = 0; i < n; i++) {
fp_free(a[i]);
}
}
}
int fp_cmp_dig(const fp_t a, dig_t b) {
#if FP_RDC == MONTY
fp_t t;
int r = CMP_EQ;
fp_null(t);
TRY {
fp_new(t);
fp_prime_conv_dig(t, b);
r = fp_cmp(a, t);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(t);
}
return r;
#else
for (int i = 1; i < FP_DIGS; i++) {
if (a[i] > 0) {
return CMP_GT;
}
}
return fp_cmp1_low(a[0], b);
#endif
}
/*
* Uncompress twisted Edwards curve point.
*/
int ed_upk(ed_t r, const ed_t p) {
int result = 1;
fp_t t;
TRY {
fp_new(t);
fp_copy(r->y, p->y);
ed_recover_x(t, p->y, core_get()->ed_d, core_get()->ed_a);
if (fp_get_bit(t, 0) != fp_get_bit(p->x, 0)) {
fp_neg(t, t);
}
fp_copy(r->x, t);
#if ED_ADD == EXTND
fp_mul(r->t, r->x, r->y);
#endif
fp_set_dig(r->z, 1);
r->norm = 1;
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
return result;
}
void fp2_mul_art(fp2_t c, fp2_t a) {
fp_t t;
fp_null(t);
TRY {
fp_new(t);
#ifdef FP_QNRES
/* (a_0 + a_1 * i) * i = -a_1 + a_0 * i. */
fp_copy(t, a[0]);
fp_neg(c[0], a[1]);
fp_copy(c[1], t);
#else
/* (a_0 + a_1 * u) * u = (a_1 * u^2) + a_0 * u. */
fp_copy(t, a[0]);
fp_neg(c[0], a[1]);
for (int i = -1; i > fp_prime_get_qnr(); i--) {
fp_sub(c[0], c[0], a[1]);
}
fp_copy(c[1], t);
#endif
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
}
int ep_upk(ep_t r, const ep_t p) {
fp_t t;
int result = 0;
fp_null(t);
TRY {
fp_new(t);
ep_rhs(t, p);
/* t0 = sqrt(x1^3 + a * x1 + b). */
result = fp_srt(t, t);
if (result) {
/* Verify if least significant bit of the result matches the
* compressed y-coordinate. */
if (fp_get_bit(t, 0) != fp_get_bit(p->y, 0)) {
fp_neg(t, t);
}
fp_copy(r->x, p->x);
fp_copy(r->y, t);
fp_set_dig(r->z, 1);
r->norm = 1;
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
return result;
}
/*
* Free lwp fpu regs.
*/
void
lwp_freeregs(klwp_t *lwp, int isexec)
{
kfpu_t *fp = lwptofpu(lwp);
if (lwptot(lwp) == curthread)
fp->fpu_fprs = _fp_read_fprs();
if ((fp->fpu_en) || (fp->fpu_fprs & FPRS_FEF))
fp_free(fp, isexec);
}
void fp_exp_monty(fp_t c, const fp_t a, const bn_t b) {
fp_t t[2];
fp_null(t[0]);
fp_null(t[1]);
if (bn_is_zero(b)) {
fp_set_dig(c, 1);
return;
}
TRY {
fp_new(t[0]);
fp_new(t[1]);
fp_set_dig(t[0], 1);
fp_copy(t[1], a);
for (int i = bn_bits(b) - 1; i >= 0; i--) {
int j = bn_get_bit(b, i);
dv_swap_cond(t[0], t[1], FP_DIGS, j ^ 1);
fp_mul(t[0], t[0], t[1]);
fp_sqr(t[1], t[1]);
dv_swap_cond(t[0], t[1], FP_DIGS, j ^ 1);
}
if (bn_sign(b) == BN_NEG) {
fp_inv(c, t[0]);
} else {
fp_copy(c, t[0]);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t[1]);
fp_free(t[0]);
}
}
int ed_affine_is_valid(const fp_t x, const fp_t y) {
fp_t tmpFP0;
fp_t tmpFP1;
fp_t tmpFP2;
fp_null(tmpFP0);
fp_null(tmpFP1);
fp_null(tmpFP2);
int r = 0;
TRY {
fp_new(tmpFP0);
fp_new(tmpFP1);
fp_new(tmpFP2);
// a * X^2 + Y^2 - 1 - d * X^2 * Y^2 =?= 0
fp_sqr(tmpFP0, x);
fp_mul(tmpFP0, core_get()->ed_a, tmpFP0);
fp_sqr(tmpFP1, y);
fp_add(tmpFP1, tmpFP0, tmpFP1);
fp_sub_dig(tmpFP1, tmpFP1, 1);
fp_sqr(tmpFP0, x);
fp_mul(tmpFP0, core_get()->ed_d, tmpFP0);
fp_sqr(tmpFP2, y);
fp_mul(tmpFP2, tmpFP0, tmpFP2);
fp_sub(tmpFP0, tmpFP1, tmpFP2);
r = fp_is_zero(tmpFP0);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(tmpFP0);
fp_free(tmpFP1);
fp_free(tmpFP2);
}
return r;
}
/*
* Responsible for reading from the serial port, assembling packets and
* sending them via a Redis PUBLISH command.
*/
void
redis_transmitter(char *hostname, int port)
{
int i, n;
unsigned char rdbuffer[32];
char wrbuffer[32];
struct fonz *fp;
redisContext *ctxt;
/*
* Initialize the Fonz packet receiver, and the Redis connection.
*/
fp_init(4, 0);
ctxt = redisConnect(hostname, port);
if (ctxt->err) {
fprintf(stderr, "?redis (tx) error: %s\n", ctxt->errstr);
exit(1);
}
/*
* Loop forever, pulling packets from the serial wire and sending
* them out via Redis PUB/SUB.
*/
while (1) {
/*
* Read a pile of data from the serial device, and stuff
* it into the packet receiver.
*/
if ((n = read(filedes, rdbuffer, sizeof(rdbuffer))) < 0) {
perror("redis_tx: read");
exit(1);
}
for (i = 0; i < n; i++)
fp_indata(rdbuffer[i]);
/*
* Process any packets on the receive queue.
*/
while ((fp = fp_receive()) != NULL) {
if (fp->cmd & FONZ_RESPONSE)
sprintf(wrbuffer, "[%u,%u,%u]", fp->cmd & 0xff, fp->arg1 & 0xff, fp->arg2 & 0xff);
else
sprintf(wrbuffer, "%u", fp->cmd & 0xff);
if (txlfp != NULL)
fprintf(txlfp, "< {%s}\n", wrbuffer);
redisCommand(ctxt, "PUBLISH fonz-in %s", wrbuffer);
fp_free(fp);
}
}
}
int ed_is_valid(const ed_t p) {
ed_t t;
#if ED_ADD == EXTND
fp_t x_times_y;
#endif
int r = 0;
ed_null(t);
#if ED_ADD == EXTND
fp_null(x_times_y);
#endif
if (fp_is_zero(p->z)) {
r = 0;
} else {
TRY {
#if ED_ADD == EXTND
fp_new(x_times_y);
#endif
ed_new(t);
ed_norm(t, p);
// check t coordinate
#if ED_ADD == PROJC
r = ed_affine_is_valid(t->x, t->y);
#elif ED_ADD == EXTND
fp_mul(x_times_y, t->x, t->y);
if (fp_cmp(x_times_y, t->t) != CMP_EQ) {
r = 0;
} else {
r = ed_affine_is_valid(t->x, t->y);
}
#endif
// if (r == 0) {
// util_printf("\n\n(X, Y, T, Z) = \n");
// ed_print(p);
// }
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
#if ED_ADD == EXTND
fp_free(x_times_y);
#endif
ed_free(t);
}
}
return r;
}
int fp_cmp_dig(const fp_t a, dig_t b) {
fp_t t;
int r = RLC_EQ;
fp_null(t);
TRY {
fp_new(t);
fp_prime_conv_dig(t, b);
r = fp_cmp(a, t);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(t);
}
return r;
}
void fp_sqr_comba(fp_t c, const fp_t a) {
dv_t t;
dv_null(t);
TRY {
dv_new(t);
fp_sqrn_low(t, a);
fp_rdc(c, t);
} CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
}
int ed_is_infty(const ed_t p) {
assert(!fp_is_zero(p->z));
int ret = 0;
fp_t norm_y;
fp_null(norm_y);
fp_new(norm_y);
fp_inv(norm_y, p->z);
fp_mul(norm_y, p->y, norm_y);
if (fp_cmp_dig(norm_y, 1) == CMP_EQ && fp_is_zero(p->x)) {
ret = 1;
}
fp_free(norm_y);
return ret;
}
/**
* Detects an optimization based on the curve coefficients.
*
* @param[out] opt - the resulting optimization.
* @param[in] a - the curve coefficient.
*/
static void detect_opt(int *opt, fp_t a) {
fp_t t;
fp_null(t);
TRY {
fp_new(t);
fp_prime_conv_dig(t, 3);
fp_neg(t, t);
if (fp_cmp(a, t) == CMP_EQ) {
*opt = OPT_MINUS3;
} else {
if (fp_is_zero(a)) {
*opt = OPT_ZERO;
} else {
fp_set_dig(t, 1);
if (fp_cmp_dig(a, 1) == CMP_EQ) {
*opt = OPT_ONE;
} else {
if (fp_cmp_dig(a, 2) == CMP_EQ) {
*opt = OPT_TWO;
} else {
if (fp_bits(a) <= FP_DIGIT) {
*opt = OPT_DIGIT;
} else {
*opt = RELIC_OPT_NONE;
}
}
}
}
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
}
void fp3_mul_art(fp3_t c, fp3_t a) {
fp_t t;
fp_null(t);
TRY {
fp_new(t);
/* (a_0 + a_1 * u + a_1 * u^2) * u = a_0 * u + a_1 * u^2 + a_1 * u^3. */
fp_copy(t, a[0]);
fp_dbl(c[0], a[2]);
fp_neg(c[0], c[0]);
fp_copy(c[2], a[1]);
fp_copy(c[1], t);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
}
void fp_exp_basic(fp_t c, const fp_t a, const bn_t b) {
int i, l;
fp_t r;
fp_null(r);
if (bn_is_zero(b)) {
fp_set_dig(c, 1);
return;
}
TRY {
fp_new(r);
l = bn_bits(b);
fp_copy(r, a);
for (i = l - 2; i >= 0; i--) {
fp_sqr(r, r);
if (bn_get_bit(b, i)) {
fp_mul(r, r, a);
}
}
if (bn_sign(b) == BN_NEG) {
fp_inv(c, r);
} else {
fp_copy(c, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(r);
}
}
void fp_sqr_basic(fp_t c, const fp_t a) {
int i;
dv_t t;
dv_null(t);
TRY {
dv_new(t);
dv_zero(t, 2 * RLC_FP_DIGS);
for (i = 0; i < RLC_FP_DIGS; i++) {
bn_sqra_low(t + (2 * i), a + i, RLC_FP_DIGS - i);
}
fp_rdc(c, t);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t);
}
}
void pp_dbl_k2_basic(fp2_t l, ep_t r, ep_t p, ep_t q) {
fp_t s;
ep_t t;
fp_null(s);
ep_null(t);
TRY {
fp_new(s);
ep_new(t);
ep_copy(t, p);
ep_dbl_slp_basic(r, s, p);
fp_add(l[0], t->x, q->x);
fp_mul(l[0], l[0], s);
fp_sub(l[0], t->y, l[0]);
fp_copy(l[1], q->y);
} CATCH_ANY {
THROW(ERR_CAUGHT);
} FINALLY {
fp_free(s);
ep_free(t);
}
}
void ep_curve_clean(void) {
ctx_t *ctx = core_get();
#if ALLOC == STATIC
fp_free(ctx->ep_g.x);
fp_free(ctx->ep_g.y);
fp_free(ctx->ep_g.z);
#ifdef EP_PRECO
for (int i = 0; i < RELIC_EP_TABLE; i++) {
fp_free(ctx->ep_pre[i].x);
fp_free(ctx->ep_pre[i].y);
fp_free(ctx->ep_pre[i].z);
}
#endif
#endif
bn_clean(&ctx->ep_r);
bn_clean(&ctx->ep_h);
#if defined(EP_ENDOM) && (EP_MUL == LWNAF || EP_FIX == LWNAF || !defined(STRIP))
for (int i = 0; i < 3; i++) {
bn_clean(&(ctx->ep_v1[i]));
bn_clean(&(ctx->ep_v2[i]));
}
#endif
}
void ep_param_set(int param) {
int plain = 0, endom = 0, super = 0;
char str[2 * FP_BYTES + 2];
fp_t a, b, beta;
ep_t g;
bn_t r, h, lamb;
fp_null(a);
fp_null(b);
fp_null(beta);
bn_null(lamb);
ep_null(g);
bn_null(r);
bn_null(h);
TRY {
fp_new(a);
fp_new(b);
fp_new(beta);
bn_new(lamb);
ep_new(g);
bn_new(r);
bn_new(h);
core_get()->ep_id = 0;
switch (param) {
#if defined(EP_ENDOM) && FP_PRIME == 158
case BN_P158:
ASSIGNK(BN_P158, BN_158);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 160
case SECG_P160:
ASSIGN(SECG_P160, SECG_160);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 160
case SECG_K160:
ASSIGNK(SECG_K160, SECG_160D);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 192
case NIST_P192:
ASSIGN(NIST_P192, NIST_192);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 192
case SECG_K192:
ASSIGNK(SECG_K192, SECG_192);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 221
case CURVE_22103:
ASSIGN(CURVE_22103, PRIME_22103);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 224
case NIST_P224:
ASSIGN(NIST_P224, NIST_224);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 224
case SECG_K224:
ASSIGNK(SECG_K224, SECG_224);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 226
case CURVE_4417:
ASSIGN(CURVE_4417, PRIME_22605);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 254
case BN_P254:
ASSIGNK(BN_P254, BN_254);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 251
case CURVE_1174:
ASSIGN(CURVE_1174, PRIME_25109);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 255
case CURVE_25519:
ASSIGN(CURVE_25519, PRIME_25519);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 256
case NIST_P256:
ASSIGN(NIST_P256, NIST_256);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 256
case SECG_K256:
ASSIGNK(SECG_K256, SECG_256);
endom = 1;
break;
case BN_P256:
ASSIGNK(BN_P256, BN_256);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) & FP_PRIME == 382
case CURVE_67254:
ASSIGN(CURVE_67254, PRIME_382105);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 383
case CURVE_383187:
ASSIGN(CURVE_383187, PRIME_383187);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 384
case NIST_P384:
ASSIGN(NIST_P384, NIST_384);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 477
case B24_P477:
ASSIGN(B24_P477, B24_477);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 508
case KSS_P508:
ASSIGNK(KSS_P508, KSS_508);
endom = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 511
case CURVE_511187:
ASSIGN(CURVE_511187, PRIME_511187);
plain = 1;
break;
#endif
#if defined(EP_PLAIN) && FP_PRIME == 521
case NIST_P521:
ASSIGN(NIST_P521, NIST_521);
plain = 1;
break;
#endif
#if defined(EP_ENDOM) && FP_PRIME == 638
case BN_P638:
ASSIGNK(BN_P638, BN_638);
endom = 1;
break;
case B12_P638:
ASSIGNK(B12_P638, B12_638);
endom = 1;
break;
#endif
#if defined(EP_SUPER) && FP_PRIME == 1536
case SS_P1536:
ASSIGN(SS_P1536, SS_1536);
super = 1;
break;
#endif
default:
(void)str;
THROW(ERR_NO_VALID);
break;
}
/* Do not generate warnings. */
(void)endom;
(void)plain;
(void)beta;
fp_zero(g->z);
fp_set_dig(g->z, 1);
g->norm = 1;
#if defined(EP_PLAIN)
if (plain) {
ep_curve_set_plain(a, b, g, r, h);
core_get()->ep_id = param;
}
#endif
#if defined(EP_ENDOM)
if (endom) {
ep_curve_set_endom(b, g, r, h, beta, lamb);
core_get()->ep_id = param;
}
#endif
#if defined(EP_SUPER)
if (super) {
ep_curve_set_super(a, b, g, r, h);
core_get()->ep_id = param;
}
#endif
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(a);
fp_free(b);
fp_free(beta);
bn_free(lamb);
ep_free(g);
bn_free(r);
bn_free(h);
}
}
/* ARGSUSED */
int
pipe(proc_t p, __unused struct pipe_args *uap, int32_t *retval)
{
struct fileproc *rf, *wf;
struct pipe *rpipe, *wpipe;
lck_mtx_t *pmtx;
int fd, error;
if ((pmtx = lck_mtx_alloc_init(pipe_mtx_grp, pipe_mtx_attr)) == NULL)
return (ENOMEM);
rpipe = wpipe = NULL;
if (pipe_create(&rpipe) || pipe_create(&wpipe)) {
error = ENFILE;
goto freepipes;
}
/*
* allocate the space for the normal I/O direction up
* front... we'll delay the allocation for the other
* direction until a write actually occurs (most likely it won't)...
*/
error = pipespace(rpipe, choose_pipespace(rpipe->pipe_buffer.size, 0));
if (error)
goto freepipes;
TAILQ_INIT(&rpipe->pipe_evlist);
TAILQ_INIT(&wpipe->pipe_evlist);
error = falloc(p, &rf, &fd, vfs_context_current());
if (error) {
goto freepipes;
}
retval[0] = fd;
/*
* for now we'll create half-duplex pipes(refer returns section above).
* this is what we've always supported..
*/
rf->f_flag = FREAD;
rf->f_data = (caddr_t)rpipe;
rf->f_ops = &pipeops;
error = falloc(p, &wf, &fd, vfs_context_current());
if (error) {
fp_free(p, retval[0], rf);
goto freepipes;
}
wf->f_flag = FWRITE;
wf->f_data = (caddr_t)wpipe;
wf->f_ops = &pipeops;
rpipe->pipe_peer = wpipe;
wpipe->pipe_peer = rpipe;
/* both structures share the same mutex */
rpipe->pipe_mtxp = wpipe->pipe_mtxp = pmtx;
retval[1] = fd;
#if CONFIG_MACF
/*
* XXXXXXXX SHOULD NOT HOLD FILE_LOCK() XXXXXXXXXXXX
*
* struct pipe represents a pipe endpoint. The MAC label is shared
* between the connected endpoints. As a result mac_pipe_label_init() and
* mac_pipe_label_associate() should only be called on one of the endpoints
* after they have been connected.
*/
mac_pipe_label_init(rpipe);
mac_pipe_label_associate(kauth_cred_get(), rpipe);
wpipe->pipe_label = rpipe->pipe_label;
#endif
proc_fdlock_spin(p);
procfdtbl_releasefd(p, retval[0], NULL);
procfdtbl_releasefd(p, retval[1], NULL);
fp_drop(p, retval[0], rf, 1);
fp_drop(p, retval[1], wf, 1);
proc_fdunlock(p);
return (0);
freepipes:
pipeclose(rpipe);
pipeclose(wpipe);
lck_mtx_free(pmtx, pipe_mtx_grp);
return (error);
}
/**
* Doubles a point represented in affine coordinates on an ordinary prime
* elliptic curve.
*
* @param[out] r - the result.
* @param[out] s - the slope.
* @param[in] p - the point to double.
*/
static void ep_dbl_basic_imp(ep_t r, fp_t s, const ep_t p) {
fp_t t0, t1, t2;
fp_null(t0);
fp_null(t1);
fp_null(t2);
TRY {
fp_new(t0);
fp_new(t1);
fp_new(t2);
/* t0 = 1/2 * y1. */
fp_dbl(t0, p->y);
fp_inv(t0, t0);
/* t1 = 3 * x1^2 + a. */
fp_sqr(t1, p->x);
fp_copy(t2, t1);
fp_dbl(t1, t1);
fp_add(t1, t1, t2);
switch (ep_curve_opt_a()) {
case OPT_ZERO:
break;
case OPT_ONE:
fp_add_dig(t1, t1, (dig_t)1);
break;
#if FP_RDC != MONTY
case OPT_DIGIT:
fp_add_dig(t1, t1, ep_curve_get_a()[0]);
break;
#endif
default:
fp_add(t1, t1, ep_curve_get_a());
break;
}
/* t1 = (3 * x1^2 + a)/(2 * y1). */
fp_mul(t1, t1, t0);
if (s != NULL) {
fp_copy(s, t1);
}
/* t2 = t1^2. */
fp_sqr(t2, t1);
/* x3 = t1^2 - 2 * x1. */
fp_dbl(t0, p->x);
fp_sub(t0, t2, t0);
/* y3 = t1 * (x1 - x3) - y1. */
fp_sub(t2, p->x, t0);
fp_mul(t1, t1, t2);
fp_sub(r->y, t1, p->y);
fp_copy(r->x, t0);
fp_copy(r->z, p->z);
r->norm = 1;
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
fp_free(t0);
fp_free(t1);
fp_free(t2);
}
}
int fp_srt(fp_t c, const fp_t a) {
bn_t e;
fp_t t0;
fp_t t1;
int r = 0;
bn_null(e);
fp_null(t0);
fp_null(t1);
TRY {
bn_new(e);
fp_new(t0);
fp_new(t1);
/* Make e = p. */
e->used = FP_DIGS;
dv_copy(e->dp, fp_prime_get(), FP_DIGS);
if (fp_prime_get_mod8() == 3 || fp_prime_get_mod8() == 7) {
/* Easy case, compute a^((p + 1)/4). */
bn_add_dig(e, e, 1);
bn_rsh(e, e, 2);
fp_exp(t0, a, e);
fp_sqr(t1, t0);
r = (fp_cmp(t1, a) == CMP_EQ);
fp_copy(c, t0);
} else {
int f = 0, m = 0;
/* First, check if there is a root. Compute t1 = a^((p - 1)/2). */
bn_rsh(e, e, 1);
fp_exp(t0, a, e);
if (fp_cmp_dig(t0, 1) != CMP_EQ) {
/* Nope, there is no square root. */
r = 0;
} else {
r = 1;
/* Find a quadratic non-residue modulo p, that is a number t2
* such that (t2 | p) = t2^((p - 1)/2)!= 1. */
do {
fp_rand(t1);
fp_exp(t0, t1, e);
} while (fp_cmp_dig(t0, 1) == CMP_EQ);
/* Write p - 1 as (e * 2^f), odd e. */
bn_lsh(e, e, 1);
while (bn_is_even(e)) {
bn_rsh(e, e, 1);
f++;
}
/* Compute t2 = t2^e. */
fp_exp(t1, t1, e);
/* Compute t1 = a^e, c = a^((e + 1)/2) = a^(e/2 + 1), odd e. */
bn_rsh(e, e, 1);
fp_exp(t0, a, e);
fp_mul(e->dp, t0, a);
fp_sqr(t0, t0);
fp_mul(t0, t0, a);
fp_copy(c, e->dp);
while (1) {
if (fp_cmp_dig(t0, 1) == CMP_EQ) {
break;
}
fp_copy(e->dp, t0);
for (m = 0; (m < f) && (fp_cmp_dig(t0, 1) != CMP_EQ); m++) {
fp_sqr(t0, t0);
}
fp_copy(t0, e->dp);
for (int i = 0; i < f - m - 1; i++) {
fp_sqr(t1, t1);
}
fp_mul(c, c, t1);
fp_sqr(t1, t1);
fp_mul(t0, t0, t1);
f = m;
}
}
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(e);
fp_free(t0);
fp_free(t1);
}
return r;
}
