void ep_curve_set_endom(const fp_t b, const ep_t g, const bn_t r, const bn_t h,
const fp_t beta, const bn_t l) {
int bits = bn_bits(r);
ctx_t *ctx = core_get();
ctx->ep_is_endom = 1;
ctx->ep_is_super = 0;
fp_zero(ctx->ep_a);
fp_copy(ctx->ep_b, b);
detect_opt(&(ctx->ep_opt_a), ctx->ep_a);
detect_opt(&(ctx->ep_opt_b), ctx->ep_b);
#if EP_MUL == LWNAF || EP_FIX == COMBS || EP_FIX == LWNAF || EP_SIM == INTER || !defined(STRIP)
fp_copy(ctx->beta, beta);
bn_gcd_ext_mid(&(ctx->ep_v1[1]), &(ctx->ep_v1[2]), &(ctx->ep_v2[1]),
&(ctx->ep_v2[2]), l, r);
/* l = v1[1] * v2[2] - v1[2] * v2[1], r = l / 2. */
bn_mul(&(ctx->ep_v1[0]), &(ctx->ep_v1[1]), &(ctx->ep_v2[2]));
bn_mul(&(ctx->ep_v2[0]), &(ctx->ep_v1[2]), &(ctx->ep_v2[1]));
bn_sub(&(ctx->ep_r), &(ctx->ep_v1[0]), &(ctx->ep_v2[0]));
bn_hlv(&(ctx->ep_r), &(ctx->ep_r));
/* v1[0] = round(v2[2] * 2^|n| / l). */
bn_lsh(&(ctx->ep_v1[0]), &(ctx->ep_v2[2]), bits + 1);
if (bn_sign(&(ctx->ep_v1[0])) == BN_POS) {
bn_add(&(ctx->ep_v1[0]), &(ctx->ep_v1[0]), &(ctx->ep_r));
} else {
bn_sub(&(ctx->ep_v1[0]), &(ctx->ep_v1[0]), &(ctx->ep_r));
}
bn_dbl(&(ctx->ep_r), &(ctx->ep_r));
bn_div(&(ctx->ep_v1[0]), &(ctx->ep_v1[0]), &(ctx->ep_r));
if (bn_sign(&ctx->ep_v1[0]) == BN_NEG) {
bn_add_dig(&(ctx->ep_v1[0]), &(ctx->ep_v1[0]), 1);
}
/* v2[0] = round(v1[2] * 2^|n| / l). */
bn_lsh(&(ctx->ep_v2[0]), &(ctx->ep_v1[2]), bits + 1);
if (bn_sign(&(ctx->ep_v2[0])) == BN_POS) {
bn_add(&(ctx->ep_v2[0]), &(ctx->ep_v2[0]), &(ctx->ep_r));
} else {
bn_sub(&(ctx->ep_v2[0]), &(ctx->ep_v2[0]), &(ctx->ep_r));
}
bn_div(&(ctx->ep_v2[0]), &(ctx->ep_v2[0]), &(ctx->ep_r));
if (bn_sign(&ctx->ep_v2[0]) == BN_NEG) {
bn_add_dig(&(ctx->ep_v2[0]), &(ctx->ep_v2[0]), 1);
}
bn_neg(&(ctx->ep_v2[0]), &(ctx->ep_v2[0]));
#endif
ep_norm(&(ctx->ep_g), g);
bn_copy(&(ctx->ep_r), r);
bn_copy(&(ctx->ep_h), h);
#if defined(EP_PRECO)
ep_mul_pre((ep_t *)ep_curve_get_tab(), &(ctx->ep_g));
#endif
}
int cp_bdpe_dec(dig_t *out, uint8_t *in, int in_len, bdpe_t prv) {
bn_t m, t, z;
unsigned i;
int size, result = STS_OK;
size = bn_size_bin(prv->n);
if (in_len < 0 || in_len != size) {
return STS_ERR;
}
bn_null(m);
bn_null(t);
bn_null(z);
TRY {
bn_new(m);
bn_new(t);
bn_new(z);
/* Compute t = (p-1)(q-1)/block. */
bn_mul(t, prv->p, prv->q);
bn_sub(t, t, prv->p);
bn_sub(t, t, prv->q);
bn_add_dig(t, t, 1);
bn_div_dig(t, t, prv->t);
bn_read_bin(m, in, in_len);
bn_mxp(m, m, t, prv->n);
bn_mxp(t, prv->y, t, prv->n);
for (i = 0; i < prv->t; i++) {
bn_mxp_dig(z, t, i, prv->n);
if (bn_cmp(z, m) == CMP_EQ) {
*out = i;
break;
}
}
if (i == prv->t) {
result = STS_ERR;
}
} CATCH_ANY {
result = STS_ERR;
}
FINALLY {
bn_free(m);
bn_free(t);
bn_free(z);
}
return result;
}
int bn_sub_mod(bn_st * out, bn_st * in1, bn_st * in2, bn_st * modulus)
{
if (bn_cmp(in1,in2) == CMP_GT)
{
// If in1 > in2 we just subtract
bn_sub(out,in1,in2);
}
else
{
// Otherwise compute mod + in1 - in2
bn_add(out, modulus, in1);
bn_sub(out,out,in2);
}
return 0;
}
status_t element_sub(element_t c, element_t a, element_t b)
{
GroupType type = a->type;
EXIT_IF_NOT_SAME(a, b);
LEAVE_IF(a->isInitialized != TRUE || b->isInitialized != TRUE, "uninitialized arguments.");
LEAVE_IF( c->type != type, "result initialized but invalid type.");
if(type == ZR) {
bn_sub(c->bn, a->bn, b->bn);
bn_mod(c->bn, c->bn, c->order);
}
else if(type == G1) {
g1_sub(c->g1, a->g1, b->g1);
g1_norm(c->g1, c->g1);
}
else if(type == G2) {
g2_sub(c->g2, a->g2, b->g2);
g2_norm(c->g2, c->g2);
}
else {
return ELEMENT_INVALID_TYPES;
}
return ELEMENT_OK;
}
int cp_ecss_sig(bn_t e, bn_t s, uint8_t *msg, int len, bn_t d) {
bn_t n, k, x, r;
ec_t p;
uint8_t hash[MD_LEN];
uint8_t m[len + FC_BYTES];
int result = STS_OK;
bn_null(n);
bn_null(k);
bn_null(x);
bn_null(r);
ec_null(p);
TRY {
bn_new(n);
bn_new(k);
bn_new(x);
bn_new(r);
ec_new(p);
ec_curve_get_ord(n);
do {
bn_rand_mod(k, n);
ec_mul_gen(p, k);
ec_get_x(x, p);
bn_mod(r, x, n);
} while (bn_is_zero(r));
memcpy(m, msg, len);
bn_write_bin(m + len, FC_BYTES, r);
md_map(hash, m, len + FC_BYTES);
if (8 * MD_LEN > bn_bits(n)) {
len = CEIL(bn_bits(n), 8);
bn_read_bin(e, hash, len);
bn_rsh(e, e, 8 * MD_LEN - bn_bits(n));
} else {
bn_read_bin(e, hash, MD_LEN);
}
bn_mod(e, e, n);
bn_mul(s, d, e);
bn_mod(s, s, n);
bn_sub(s, n, s);
bn_add(s, s, k);
bn_mod(s, s, n);
}
CATCH_ANY {
result = STS_ERR;
}
FINALLY {
bn_free(n);
bn_free(k);
bn_free(x);
bn_free(r);
ec_free(p);
}
return result;
}
int cp_bgn_dec2(dig_t *out, g2_t in[2], bgn_t prv) {
bn_t r, n;
g2_t s, t, u;
int i, result = STS_ERR;
bn_null(n);
bn_null(r);
g2_null(s);
g2_null(t);
g2_null(u);
TRY {
bn_new(n);
bn_new(r);
g2_new(s);
g2_new(t);
g2_new(u);
g2_get_ord(n);
/* Compute T = x(ym + r)G - (zm + xr)G = m(xy - z)G. */
g2_mul(t, in[0], prv->x);
g2_sub(t, t, in[1]);
g2_norm(t, t);
/* Compute U = (xy - z)G and find m. */
bn_mul(r, prv->x, prv->y);
bn_sub(r, r, prv->z);
bn_mod(r, r, n);
g2_mul_gen(s, r);
g2_copy(u, s);
if (g2_is_infty(t) == 1) {
*out = 0;
result = STS_OK;
} else {
for (i = 0; i < INT_MAX; i++) {
if (g2_cmp(t, u) == CMP_EQ) {
*out = i + 1;
result = STS_OK;
break;
}
g2_add(u, u, s);
g2_norm(u, u);
}
}
} CATCH_ANY {
result = STS_ERR;
}
FINALLY {
bn_free(n);
bn_free(r);
g2_free(s);
g2_free(t);
g2_free(u);
}
return result;
}
static char *
kcl_z_sub(z_t *z, cint_t *a, cint_t *b, cint_t **r)
{
bn_t *bn;
char *err;
bn = bn_sub(z->z_data, NULL, a->cint_data, b->cint_data);
err = kcl_z_set_result(r, bn);
bn_freetbuf(z->z_data, bn);
return(err);
}
void fp_prime_set_pmers(const int *f, int len) {
bn_t p, t;
bn_null(p);
bn_null(t);
TRY {
bn_new(p);
bn_new(t);
if (len >= MAX_TERMS) {
THROW(ERR_NO_VALID);
}
bn_set_2b(p, f[len - 1]);
for (int i = len - 2; i > 0; i--) {
if (f[i] > 0) {
bn_set_2b(t, f[i]);
bn_add(p, p, t);
} else {
bn_set_2b(t, -f[i]);
bn_sub(p, p, t);
}
}
if (f[0] > 0) {
bn_add_dig(p, p, f[0]);
} else {
bn_sub_dig(p, p, -f[0]);
}
#if FP_RDC == QUICK || !defined(STRIP)
ctx_t *ctx = core_get();
for (int i = 0; i < len; i++) {
ctx->sps[i] = f[i];
}
ctx->sps[len] = 0;
ctx->sps_len = len;
#endif /* FP_RDC == QUICK */
fp_prime_set(p);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(p);
bn_free(t);
}
}
int igraph_biguint_sub(igraph_biguint_t *res, igraph_biguint_t *left,
igraph_biguint_t *right) {
long int size_left=igraph_biguint_size(left);
long int size_right=igraph_biguint_size(right);
if (size_left > size_right) {
IGRAPH_CHECK(igraph_biguint_resize(right, size_left));
size_right=size_left;
} else if (size_left < size_right) {
IGRAPH_CHECK(igraph_biguint_resize(left, size_right));
size_left=size_right;
}
IGRAPH_CHECK(igraph_biguint_resize(res, size_left));
/* We don't check return value, left should not be smaller than right! */
bn_sub( VECTOR(res->v), VECTOR(left->v), VECTOR(right->v), size_left);
return 0;
}
/**
* Precomputes additional parameters for Koblitz curves used by the w-TNAF
* multiplication algorithm.
*/
static void compute_kbltz(void) {
int u, i;
bn_t a, b, c;
bn_null(a);
bn_null(b);
bn_null(c);
TRY {
bn_new(a);
bn_new(b);
bn_new(c);
if (curve_opt_a == OPT_ZERO) {
u = -1;
} else {
u = 1;
}
bn_set_dig(a, 2);
bn_set_dig(b, 1);
if (u == -1) {
bn_neg(b, b);
}
for (i = 2; i <= FB_BITS; i++) {
bn_copy(c, b);
if (u == -1) {
bn_neg(b, b);
}
bn_dbl(a, a);
bn_sub(b, b, a);
bn_copy(a, c);
}
bn_copy(&curve_vm, b);
bn_zero(a);
bn_set_dig(b, 1);
for (i = 2; i <= FB_BITS; i++) {
bn_copy(c, b);
if (u == -1) {
bn_neg(b, b);
}
bn_dbl(a, a);
bn_sub(b, b, a);
bn_add_dig(b, b, 1);
bn_copy(a, c);
}
bn_copy(&curve_s0, b);
bn_zero(a);
bn_zero(b);
for (i = 2; i <= FB_BITS; i++) {
bn_copy(c, b);
if (u == -1) {
bn_neg(b, b);
}
bn_dbl(a, a);
bn_sub(b, b, a);
bn_sub_dig(b, b, 1);
bn_copy(a, c);
}
bn_copy(&curve_s1, b);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(a);
bn_free(b);
bn_free(c);
}
}
/**
* Divides two multiple precision integers, computing the quotient and the
* remainder.
*
* @param[out] c - the quotient.
* @param[out] d - the remainder.
* @param[in] a - the dividend.
* @param[in] b - the the divisor.
*/
static void bn_div_imp(bn_t c, bn_t d, const bn_t a, const bn_t b) {
bn_t q, x, y, r;
int sign;
bn_null(q);
bn_null(x);
bn_null(y);
bn_null(r);
/* If a < b, we're done. */
if (bn_cmp_abs(a, b) == CMP_LT) {
if (bn_sign(a) == BN_POS) {
if (c != NULL) {
bn_zero(c);
}
if (d != NULL) {
bn_copy(d, a);
}
} else {
if (c != NULL) {
bn_set_dig(c, 1);
if (bn_sign(b) == BN_POS) {
bn_neg(c, c);
}
}
if (d != NULL) {
if (bn_sign(b) == BN_POS) {
bn_add(d, a, b);
} else {
bn_sub(d, a, b);
}
}
}
return;
}
TRY {
bn_new(x);
bn_new(y);
bn_new_size(q, a->used + 1);
bn_new(r);
bn_zero(q);
bn_zero(r);
bn_abs(x, a);
bn_abs(y, b);
/* Find the sign. */
sign = (a->sign == b->sign ? BN_POS : BN_NEG);
bn_divn_low(q->dp, r->dp, x->dp, a->used, y->dp, b->used);
/* We have the quotient in q and the remainder in r. */
if (c != NULL) {
q->used = a->used - b->used + 1;
q->sign = sign;
bn_trim(q);
if (bn_sign(a) == BN_NEG) {
bn_sub_dig(c, q, 1);
} else {
bn_copy(c, q);
}
}
if (d != NULL) {
r->used = b->used;
r->sign = a->sign;
bn_trim(r);
if (bn_sign(a) == BN_NEG) {
bn_add(d, r, b);
} else {
bn_copy(d, r);
}
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(r);
bn_free(q);
bn_free(x);
bn_free(y);
}
}
static void elt_sub(u8 *d, u8 *a, u8 *b)
{
bn_sub(d, a, b, ec_p, 20);
}
void fp_param_get_var(bn_t x) {
bn_t a;
bn_null(a);
TRY {
bn_new(a);
switch (fp_param_get()) {
case BN_158:
/* x = 4000000031. */
bn_set_2b(x, 38);
bn_add_dig(x, x, 0x31);
break;
case BN_254:
/* x = -4080000000000001. */
bn_set_2b(x, 62);
bn_set_2b(a, 55);
bn_add(x, x, a);
bn_add_dig(x, x, 1);
bn_neg(x, x);
break;
case BN_256:
/* x = -600000000000219B. */
bn_set_2b(x, 62);
bn_set_2b(a, 61);
bn_add(x, x, a);
bn_set_dig(a, 0x21);
bn_lsh(a, a, 8);
bn_add(x, x, a);
bn_add_dig(x, x, 0x9B);
bn_neg(x, x);
break;
case B24_477:
/* x = -2^48 + 2^45 + 2^31 - 2^7. */
bn_set_2b(x, 48);
bn_set_2b(a, 45);
bn_sub(x, x, a);
bn_set_2b(a, 31);
bn_sub(x, x, a);
bn_set_2b(a, 7);
bn_add(x, x, a);
bn_neg(x, x);
break;
case KSS_508:
/* x = -(2^64 + 2^51 - 2^46 - 2^12). */
bn_set_2b(x, 64);
bn_set_2b(a, 51);
bn_add(x, x, a);
bn_set_2b(a, 46);
bn_sub(x, x, a);
bn_set_2b(a, 12);
bn_sub(x, x, a);
bn_neg(x, x);
break;
case BN_638:
/* x = 2^158 - 2^128 - 2^68 + 1. */
bn_set_2b(x, 158);
bn_set_2b(a, 128);
bn_sub(x, x, a);
bn_set_2b(a, 68);
bn_sub(x, x, a);
bn_add_dig(x, x, 1);
break;
case B12_638:
/* x = -2^107 + 2^105 + 2^93 + 2^5. */
bn_set_2b(x, 107);
bn_set_2b(a, 105);
bn_sub(x, x, a);
bn_set_2b(a, 93);
bn_sub(x, x, a);
bn_set_2b(a, 5);
bn_sub(x, x, a);
bn_neg(x, x);
break;
case SS_1536:
/* x = 2^255 + 2^41 + 1. */
bn_set_2b(x, 255);
bn_set_2b(a, 41);
bn_add(x, x, a);
bn_add_dig(x, x, 1);
break;
default:
THROW(ERR_NO_VALID);
break;
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(a);
}
}
void cp_ecss_sig(bn_t e, bn_t s, unsigned char *msg, int len, bn_t d) {
bn_t n, k, x, r;
ec_t p;
unsigned char hash[MD_LEN];
unsigned char m[len + EC_BYTES];
bn_null(n);
bn_null(k);
bn_null(x);
bn_null(r);
ec_null(p);
TRY {
bn_new(n);
bn_new(k);
bn_new(x);
bn_new(r);
ec_new(p);
ec_curve_get_ord(n);
do {
do {
bn_rand(k, BN_POS, bn_bits(n));
bn_mod(k, k, n);
} while (bn_is_zero(k));
ec_mul_gen(p, k);
ec_get_x(x, p);
bn_mod(r, x, n);
} while (bn_is_zero(r));
memcpy(m, msg, len);
bn_write_bin(m + len, EC_BYTES, r);
md_map(hash, m, len + EC_BYTES);
if (8 * MD_LEN > bn_bits(n)) {
len = CEIL(bn_bits(n), 8);
bn_read_bin(e, hash, len);
bn_rsh(e, e, 8 * MD_LEN - bn_bits(n));
} else {
bn_read_bin(e, hash, MD_LEN);
}
bn_mod(e, e, n);
bn_mul(s, d, e);
bn_mod(s, s, n);
bn_sub(s, n, s);
bn_add(s, s, k);
bn_mod(s, s, n);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(n);
bn_free(k);
bn_free(x);
bn_free(r);
ec_free(p);
}
}
int cp_bgn_dec(dig_t *out, gt_t in[4], bgn_t prv) {
int i, result = STS_ERR;
g1_t g;
g2_t h;
gt_t t[4];
bn_t n, r, s;
bn_null(n);
bn_null(r);
bn_null(s);
g1_null(g);
g2_null(h);
TRY {
bn_new(n);
bn_new(r);
bn_new(s);
g1_new(g);
g2_new(h);
for (i = 0; i < 4; i++) {
gt_null(t[i]);
gt_new(t[i]);
}
gt_exp(t[0], in[0], prv->x);
gt_exp(t[0], t[0], prv->x);
gt_mul(t[1], in[1], in[2]);
gt_exp(t[1], t[1], prv->x);
gt_inv(t[1], t[1]);
gt_mul(t[3], in[3], t[1]);
gt_mul(t[3], t[3], t[0]);
gt_get_ord(n);
g1_get_gen(g);
g2_get_gen(h);
bn_mul(r, prv->x, prv->y);
bn_sqr(r, r);
bn_mul(s, prv->x, prv->y);
bn_mul(s, s, prv->z);
bn_sub(r, r, s);
bn_sub(r, r, s);
bn_sqr(s, prv->z);
bn_add(r, r, s);
bn_mod(r, r, n);
pc_map(t[1], g, h);
gt_exp(t[1], t[1], r);
gt_copy(t[2], t[1]);
if (gt_is_unity(t[3]) == 1) {
*out = 0;
result = STS_OK;
} else {
for (i = 0; i < INT_MAX; i++) {
if (gt_cmp(t[2], t[3]) == CMP_EQ) {
*out = i + 1;
result = STS_OK;
break;
}
gt_mul(t[2], t[2], t[1]);
}
}
} CATCH_ANY {
result = STS_ERR;
} FINALLY {
bn_free(n);
bn_free(r);
bn_free(s);
g1_free(g);
g2_free(h);
for (i = 0; i < 4; i++) {
gt_free(t[i]);
}
}
return result;
}
/**
* Computes the square of a multiple precision integer using recursive Karatsuba
* squaring.
*
* @param[out] c - the result.
* @param[in] a - the multiple precision integer to square.
* @param[in] level - the number of Karatsuba steps to apply.
*/
static void bn_sqr_karat_imp(bn_t c, const bn_t a, int level) {
int h;
bn_t a0, a1, a0a0, a1a1, t;
const dig_t *tmpa;
dig_t *t0;
bn_null(a0);
bn_null(a1);
bn_null(a0a0);
bn_null(a1a1);
bn_null(t);
/* Compute half the digits of a or b. */
h = a->used >> 1;
TRY {
/* Allocate the temp variables. */
bn_new(a0);
bn_new(a1);
bn_new(a0a0);
bn_new(a1a1);
bn_new(t);
a0->used = h;
a1->used = a->used - h;
tmpa = a->dp;
/* a = a1 || a0 */
t0 = a0->dp;
for (int i = 0; i < h; i++, t0++, tmpa++)
*t0 = *tmpa;
t0 = a1->dp;
for (int i = 0; i < a1->used; i++, t0++, tmpa++)
*t0 = *tmpa;
bn_trim(a0);
if (level <= 1) {
/* a0a0 = a0 * a0 and a1a1 = a1 * a1 */
#if BN_SQR == BASIC
bn_sqr_basic(a0a0, a0);
bn_sqr_basic(a1a1, a1);
#elif BN_SQR == COMBA
bn_sqr_comba(a0a0, a0);
bn_sqr_comba(a1a1, a1);
#elif BN_SQR == MULTP
bn_mul_comba(a0a0, a0, a0);
bn_mul_comba(a1a1, a1, a1);
#endif
} else {
bn_sqr_karat_imp(a0a0, a0, level - 1);
bn_sqr_karat_imp(a1a1, a1, level - 1);
}
/* t = (a1 + a0) */
bn_add(t, a1, a0);
if (level <= 1) {
/* t = (a1 + a0)*(a1 + a0) */
#if BN_SQR == BASIC
bn_sqr_basic(t, t);
#elif BN_SQR == COMBA
bn_sqr_comba(t, t);
#elif BN_SQR == MULTP
bn_mul_comba(t, t, t);
#endif
} else {
bn_sqr_karat_imp(t, t, level - 1);
}
/* t2 = (a0*a0 + a1*a1) */
bn_add(a0, a0a0, a1a1);
/* t = (a1 + a0)*(b1 + b0) - (a0*a0 + a1*a1) */
bn_sub(t, t, a0);
/* t = (a1 + a0)*(a1 + a0) - (a0*a0 + a1*a1) << h digits */
bn_lsh(t, t, h * BN_DIGIT);
/* t2 = a1 * b1 << 2*h digits */
bn_lsh(a1a1, a1a1, 2 * h * BN_DIGIT);
/* t = t + a0*a0 */
bn_add(t, t, a0a0);
/* c = t + a1*a1 */
bn_add(t, t, a1a1);
t->sign = BN_POS;
bn_copy(c, t);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(a0);
bn_free(a1);
bn_free(a0a0);
bn_free(a1a1);
bn_free(t);
}
}
int cp_rsa_enc(uint8_t *out, int *out_len, uint8_t *in, int in_len, rsa_t pub) {
bn_t m, eb;
int size, pad_len, result = STS_OK;
bn_null(m);
bn_null(eb);
size = bn_size_bin(pub->n);
if (pub == NULL || in_len <= 0 || in_len > (size - RSA_PAD_LEN)) {
return STS_ERR;
}
TRY {
bn_new(m);
bn_new(eb);
bn_zero(m);
bn_zero(eb);
#if CP_RSAPD == BASIC
if (pad_basic(eb, &pad_len, in_len, size, RSA_ENC) == STS_OK) {
#elif CP_RSAPD == PKCS1
if (pad_pkcs1(eb, &pad_len, in_len, size, RSA_ENC) == STS_OK) {
#elif CP_RSAPD == PKCS2
if (pad_pkcs2(eb, &pad_len, in_len, size, RSA_ENC) == STS_OK) {
#endif
bn_read_bin(m, in, in_len);
bn_add(eb, eb, m);
#if CP_RSAPD == PKCS2
pad_pkcs2(eb, &pad_len, in_len, size, RSA_ENC_FIN);
#endif
bn_mxp(eb, eb, pub->e, pub->n);
if (size <= *out_len) {
*out_len = size;
memset(out, 0, *out_len);
bn_write_bin(out, size, eb);
} else {
result = STS_ERR;
}
} else {
result = STS_ERR;
}
}
CATCH_ANY {
result = STS_ERR;
}
FINALLY {
bn_free(m);
bn_free(eb);
}
return result;
}
#if CP_RSA == BASIC || !defined(STRIP)
int cp_rsa_dec_basic(uint8_t *out, int *out_len, uint8_t *in, int in_len, rsa_t prv) {
bn_t m, eb;
int size, pad_len, result = STS_OK;
size = bn_size_bin(prv->n);
if (prv == NULL || in_len != size || in_len < RSA_PAD_LEN) {
return STS_ERR;
}
bn_null(m);
bn_null(eb);
TRY {
bn_new(m);
bn_new(eb);
bn_read_bin(eb, in, in_len);
bn_mxp(eb, eb, prv->d, prv->n);
if (bn_cmp(eb, prv->n) != CMP_LT) {
result = STS_ERR;
}
#if CP_RSAPD == BASIC
if (pad_basic(eb, &pad_len, in_len, size, RSA_DEC) == STS_OK) {
#elif CP_RSAPD == PKCS1
if (pad_pkcs1(eb, &pad_len, in_len, size, RSA_DEC) == STS_OK) {
#elif CP_RSAPD == PKCS2
if (pad_pkcs2(eb, &pad_len, in_len, size, RSA_DEC) == STS_OK) {
#endif
size = size - pad_len;
if (size <= *out_len) {
memset(out, 0, size);
bn_write_bin(out, size, eb);
*out_len = size;
} else {
result = STS_ERR;
}
} else {
result = STS_ERR;
}
}
CATCH_ANY {
result = STS_ERR;
}
FINALLY {
bn_free(m);
bn_free(eb);
}
return result;
}
#endif
#if CP_RSA == QUICK || !defined(STRIP)
int cp_rsa_dec_quick(uint8_t *out, int *out_len, uint8_t *in, int in_len, rsa_t prv) {
bn_t m, eb;
int size, pad_len, result = STS_OK;
bn_null(m);
bn_null(eb);
size = bn_size_bin(prv->n);
if (prv == NULL || in_len != size || in_len < RSA_PAD_LEN) {
return STS_ERR;
}
TRY {
bn_new(m);
bn_new(eb);
bn_read_bin(eb, in, in_len);
bn_copy(m, eb);
/* m1 = c^dP mod p. */
bn_mxp(eb, eb, prv->dp, prv->p);
/* m2 = c^dQ mod q. */
bn_mxp(m, m, prv->dq, prv->q);
/* m1 = m1 - m2 mod p. */
bn_sub(eb, eb, m);
while (bn_sign(eb) == BN_NEG) {
bn_add(eb, eb, prv->p);
}
bn_mod(eb, eb, prv->p);
/* m1 = qInv(m1 - m2) mod p. */
bn_mul(eb, eb, prv->qi);
bn_mod(eb, eb, prv->p);
/* m = m2 + m1 * q. */
bn_mul(eb, eb, prv->q);
bn_add(eb, eb, m);
if (bn_cmp(eb, prv->n) != CMP_LT) {
result = STS_ERR;
}
#if CP_RSAPD == BASIC
if (pad_basic(eb, &pad_len, in_len, size, RSA_DEC) == STS_OK) {
#elif CP_RSAPD == PKCS1
if (pad_pkcs1(eb, &pad_len, in_len, size, RSA_DEC) == STS_OK) {
#elif CP_RSAPD == PKCS2
if (pad_pkcs2(eb, &pad_len, in_len, size, RSA_DEC) == STS_OK) {
#endif
size = size - pad_len;
if (size <= *out_len) {
memset(out, 0, size);
bn_write_bin(out, size, eb);
*out_len = size;
} else {
result = STS_ERR;
}
} else {
result = STS_ERR;
}
}
CATCH_ANY {
result = STS_ERR;
}
FINALLY {
bn_free(m);
bn_free(eb);
}
return result;
}
#endif
#if CP_RSA == BASIC || !defined(STRIP)
int cp_rsa_sig_basic(uint8_t *sig, int *sig_len, uint8_t *msg, int msg_len, int hash, rsa_t prv) {
bn_t m, eb;
int size, pad_len, result = STS_OK;
uint8_t h[MD_LEN];
if (prv == NULL || msg_len < 0) {
return STS_ERR;
}
pad_len = (!hash ? MD_LEN : msg_len);
#if CP_RSAPD == PKCS2
size = bn_bits(prv->n) - 1;
size = (size / 8) + (size % 8 > 0);
if (pad_len > (size - 2)) {
return STS_ERR;
}
#else
size = bn_size_bin(prv->n);
if (pad_len > (size - RSA_PAD_LEN)) {
return STS_ERR;
}
#endif
bn_null(m);
bn_null(eb);
TRY {
bn_new(m);
bn_new(eb);
bn_zero(m);
bn_zero(eb);
int operation = (!hash ? RSA_SIG : RSA_SIG_HASH);
#if CP_RSAPD == BASIC
if (pad_basic(eb, &pad_len, pad_len, size, operation) == STS_OK) {
#elif CP_RSAPD == PKCS1
if (pad_pkcs1(eb, &pad_len, pad_len, size, operation) == STS_OK) {
#elif CP_RSAPD == PKCS2
if (pad_pkcs2(eb, &pad_len, pad_len, size, operation) == STS_OK) {
#endif
if (!hash) {
md_map(h, msg, msg_len);
bn_read_bin(m, h, MD_LEN);
bn_add(eb, eb, m);
} else {
bn_read_bin(m, msg, msg_len);
bn_add(eb, eb, m);
}
#if CP_RSAPD == PKCS2
pad_pkcs2(eb, &pad_len, bn_bits(prv->n), size, RSA_SIG_FIN);
#endif
bn_mxp(eb, eb, prv->d, prv->n);
size = bn_size_bin(prv->n);
if (size <= *sig_len) {
memset(sig, 0, size);
bn_write_bin(sig, size, eb);
*sig_len = size;
} else {
result = STS_ERR;
}
} else {
result = STS_ERR;
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(m);
bn_free(eb);
}
return result;
}
#endif
#if CP_RSA == QUICK || !defined(STRIP)
int cp_rsa_sig_quick(uint8_t *sig, int *sig_len, uint8_t *msg, int msg_len, int hash, rsa_t prv) {
bn_t m, eb;
int pad_len, size, result = STS_OK;
uint8_t h[MD_LEN];
if (prv == NULL || msg_len < 0) {
return STS_ERR;
}
pad_len = (!hash ? MD_LEN : msg_len);
#if CP_RSAPD == PKCS2
size = bn_bits(prv->n) - 1;
size = (size / 8) + (size % 8 > 0);
if (pad_len > (size - 2)) {
return STS_ERR;
}
#else
size = bn_size_bin(prv->n);
if (pad_len > (size - RSA_PAD_LEN)) {
return STS_ERR;
}
#endif
bn_null(m);
bn_null(eb);
TRY {
bn_new(m);
bn_new(eb);
bn_zero(m);
bn_zero(eb);
int operation = (!hash ? RSA_SIG : RSA_SIG_HASH);
#if CP_RSAPD == BASIC
if (pad_basic(eb, &pad_len, pad_len, size, operation) == STS_OK) {
#elif CP_RSAPD == PKCS1
if (pad_pkcs1(eb, &pad_len, pad_len, size, operation) == STS_OK) {
#elif CP_RSAPD == PKCS2
if (pad_pkcs2(eb, &pad_len, pad_len, size, operation) == STS_OK) {
#endif
if (!hash) {
md_map(h, msg, msg_len);
bn_read_bin(m, h, MD_LEN);
bn_add(eb, eb, m);
} else {
bn_read_bin(m, msg, msg_len);
bn_add(eb, eb, m);
}
#if CP_RSAPD == PKCS2
pad_pkcs2(eb, &pad_len, bn_bits(prv->n), size, RSA_SIG_FIN);
#endif
bn_copy(m, eb);
/* m1 = c^dP mod p. */
bn_mxp(eb, eb, prv->dp, prv->p);
/* m2 = c^dQ mod q. */
bn_mxp(m, m, prv->dq, prv->q);
/* m1 = m1 - m2 mod p. */
bn_sub(eb, eb, m);
while (bn_sign(eb) == BN_NEG) {
bn_add(eb, eb, prv->p);
}
bn_mod(eb, eb, prv->p);
/* m1 = qInv(m1 - m2) mod p. */
bn_mul(eb, eb, prv->qi);
bn_mod(eb, eb, prv->p);
/* m = m2 + m1 * q. */
bn_mul(eb, eb, prv->q);
bn_add(eb, eb, m);
bn_mod(eb, eb, prv->n);
size = bn_size_bin(prv->n);
if (size <= *sig_len) {
memset(sig, 0, size);
bn_write_bin(sig, size, eb);
*sig_len = size;
} else {
result = STS_ERR;
}
} else {
result = STS_ERR;
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(m);
bn_free(eb);
}
return result;
}
#endif
int cp_rsa_ver(uint8_t *sig, int sig_len, uint8_t *msg, int msg_len, int hash, rsa_t pub) {
bn_t m, eb;
int size, pad_len, result;
uint8_t h1[MAX(msg_len, MD_LEN) + 8], h2[MAX(msg_len, MD_LEN)];
/* We suppose that the signature is invalid. */
result = 0;
if (pub == NULL || msg_len < 0) {
return 0;
}
pad_len = (!hash ? MD_LEN : msg_len);
#if CP_RSAPD == PKCS2
size = bn_bits(pub->n) - 1;
if (size % 8 == 0) {
size = size / 8 - 1;
} else {
size = bn_size_bin(pub->n);
}
if (pad_len > (size - 2)) {
return 0;
}
#else
size = bn_size_bin(pub->n);
if (pad_len > (size - RSA_PAD_LEN)) {
return 0;
}
#endif
bn_null(m);
bn_null(eb);
TRY {
bn_new(m);
bn_new(eb);
bn_read_bin(eb, sig, sig_len);
bn_mxp(eb, eb, pub->e, pub->n);
int operation = (!hash ? RSA_VER : RSA_VER_HASH);
#if CP_RSAPD == BASIC
if (pad_basic(eb, &pad_len, MD_LEN, size, operation) == STS_OK) {
#elif CP_RSAPD == PKCS1
if (pad_pkcs1(eb, &pad_len, MD_LEN, size, operation) == STS_OK) {
#elif CP_RSAPD == PKCS2
if (pad_pkcs2(eb, &pad_len, bn_bits(pub->n), size, operation) == STS_OK) {
#endif
#if CP_RSAPD == PKCS2
memset(h1, 0, 8);
if (!hash) {
md_map(h1 + 8, msg, msg_len);
md_map(h2, h1, MD_LEN + 8);
memset(h1, 0, MD_LEN);
bn_write_bin(h1, size - pad_len, eb);
/* Everything went ok, so signature status is changed. */
result = util_cmp_const(h1, h2, MD_LEN);
} else {
memcpy(h1 + 8, msg, msg_len);
md_map(h2, h1, MD_LEN + 8);
memset(h1, 0, msg_len);
bn_write_bin(h1, size - pad_len, eb);
/* Everything went ok, so signature status is changed. */
result = util_cmp_const(h1, h2, msg_len);
}
#else
memset(h1, 0, MAX(msg_len, MD_LEN));
bn_write_bin(h1, size - pad_len, eb);
if (!hash) {
md_map(h2, msg, msg_len);
/* Everything went ok, so signature status is changed. */
result = util_cmp_const(h1, h2, MD_LEN);
} else {
/* Everything went ok, so signature status is changed. */
result = util_cmp_const(h1, msg, msg_len);
}
#endif
result = (result == CMP_EQ ? 1 : 0);
} else {
result = 0;
}
}
CATCH_ANY {
result = 0;
}
FINALLY {
bn_free(m);
bn_free(eb);
}
return result;
}
void fp_param_set(int param) {
bn_t t0, t1, t2, p;
int f[10] = { 0 };
bn_null(t0);
bn_null(t1);
bn_null(t2);
bn_null(p);
/* Suppress possible unused parameter warning. */
(void) f;
TRY {
bn_new(t0);
bn_new(t1);
bn_new(t2);
bn_new(p);
core_get()->fp_id = param;
switch (param) {
#if FP_PRIME == 158
case BN_158:
/* x = 4000000031. */
fp_param_get_var(t0);
/* p = 36 * x^4 + 36 * x^3 + 24 * x^2 + 6 * x + 1. */
bn_set_dig(p, 1);
bn_mul_dig(t1, t0, 6);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 24);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul(t1, t1, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
bn_mul(t0, t0, t0);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
fp_prime_set_dense(p);
break;
#elif FP_PRIME == 160
case SECG_160:
/* p = 2^160 - 2^31 + 1. */
f[0] = -1;
f[1] = -31;
f[2] = 160;
fp_prime_set_pmers(f, 3);
break;
case SECG_160D:
/* p = 2^160 - 2^32 - 2^14 - 2^12 - 2^9 - 2^8 - 2^7 - 2^3 - 2^2 - 1.*/
f[0] = -1;
f[1] = -2;
f[2] = -3;
f[3] = -7;
f[4] = -8;
f[5] = -9;
f[6] = -12;
f[7] = -14;
f[8] = -32;
f[9] = 160;
fp_prime_set_pmers(f, 10);
break;
#elif FP_PRIME == 192
case NIST_192:
/* p = 2^192 - 2^64 - 1. */
f[0] = -1;
f[1] = -64;
f[2] = 192;
fp_prime_set_pmers(f, 3);
break;
case SECG_192:
/* p = 2^192 - 2^32 - 2^12 - 2^8 - 2^7 - 2^6 - 2^3 - 1.*/
f[0] = -1;
f[1] = -3;
f[2] = -6;
f[3] = -7;
f[4] = -8;
f[5] = -12;
f[6] = -32;
f[7] = 192;
fp_prime_set_pmers(f, 8);
break;
#elif FP_PRIME == 224
case NIST_224:
/* p = 2^224 - 2^96 + 1. */
f[0] = 1;
f[1] = -96;
f[2] = 224;
fp_prime_set_pmers(f, 3);
break;
case SECG_224:
/* p = 2^224 - 2^32 - 2^12 - 2^11 - 2^9 - 2^7 - 2^4 - 2 - 1.*/
f[0] = -1;
f[1] = -1;
f[2] = -4;
f[3] = -7;
f[4] = -9;
f[5] = -11;
f[6] = -12;
f[7] = -32;
f[8] = 224;
fp_prime_set_pmers(f, 9);
break;
#elif FP_PRIME == 254
case BN_254:
/* x = -4080000000000001. */
fp_param_get_var(t0);
/* p = 36 * x^4 + 36 * x^3 + 24 * x^2 + 6 * x + 1. */
bn_set_dig(p, 1);
bn_mul_dig(t1, t0, 6);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 24);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul(t1, t1, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
bn_mul(t0, t0, t0);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
fp_prime_set_dense(p);
break;
#elif FP_PRIME == 256
case NIST_256:
/* p = 2^256 - 2^224 + 2^192 + 2^96 - 1. */
f[0] = -1;
f[1] = 96;
f[2] = 192;
f[3] = -224;
f[4] = 256;
fp_prime_set_pmers(f, 5);
break;
case SECG_256:
/* p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1. */
f[0] = -1;
f[1] = -4;
f[2] = -6;
f[3] = -7;
f[4] = -8;
f[5] = -9;
f[6] = -32;
f[7] = 256;
fp_prime_set_pmers(f, 8);
break;
case BN_256:
/* x = 6000000000001F2D. */
fp_param_get_var(t0);
/* p = 36 * x^4 + 36 * x^3 + 24 * x^2 + 6 * x + 1. */
bn_set_dig(p, 1);
bn_mul_dig(t1, t0, 6);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 24);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul(t1, t1, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
bn_mul(t0, t0, t0);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
fp_prime_set_dense(p);
break;
#elif FP_PRIME == 384
case NIST_384:
/* p = 2^384 - 2^128 - 2^96 + 2^32 - 1. */
f[0] = -1;
f[1] = 32;
f[2] = -96;
f[3] = -128;
f[4] = 384;
fp_prime_set_pmers(f, 5);
break;
#elif FP_PRIME == 477
case B24_477:
fp_param_get_var(t0);
/* p = (u - 1)^2 * (u^8 - u^4 + 1) div 3 + u. */
bn_sub_dig(p, t0, 1);
bn_sqr(p, p);
bn_sqr(t1, t0);
bn_sqr(t1, t1);
bn_sqr(t2, t1);
bn_sub(t2, t2, t1);
bn_add_dig(t2, t2, 1);
bn_mul(p, p, t2);
bn_div_dig(p, p, 3);
bn_add(p, p, t0);
fp_prime_set_dense(p);
break;
#elif FP_PRIME == 508
case KSS_508:
fp_param_get_var(t0);
/* h = (49*u^2 + 245 * u + 343)/3 */
bn_mul_dig(p, t0, 245);
bn_add_dig(p, p, 200);
bn_add_dig(p, p, 143);
bn_sqr(t1, t0);
bn_mul_dig(t2, t1, 49);
bn_add(p, p, t2);
bn_div_dig(p, p, 3);
/* n = (u^6 + 37 * u^3 + 343)/343. */
bn_mul(t1, t1, t0);
bn_mul_dig(t2, t1, 37);
bn_sqr(t1, t1);
bn_add(t2, t2, t1);
bn_add_dig(t2, t2, 200);
bn_add_dig(t2, t2, 143);
bn_div_dig(t2, t2, 49);
bn_div_dig(t2, t2, 7);
bn_mul(p, p, t2);
/* t = (u^4 + 16 * u + 7)/7. */
bn_mul_dig(t1, t0, 16);
bn_add_dig(t1, t1, 7);
bn_sqr(t2, t0);
bn_sqr(t2, t2);
bn_add(t2, t2, t1);
bn_div_dig(t2, t2, 7);
bn_add(p, p, t2);
bn_sub_dig(p, p, 1);
fp_prime_set_dense(p);
break;
#elif FP_PRIME == 521
case NIST_521:
/* p = 2^521 - 1. */
f[0] = -1;
f[1] = 521;
fp_prime_set_pmers(f, 2);
break;
#elif FP_PRIME == 638
case BN_638:
fp_param_get_var(t0);
/* p = 36 * x^4 + 36 * x^3 + 24 * x^2 + 6 * x + 1. */
bn_set_dig(p, 1);
bn_mul_dig(t1, t0, 6);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 24);
bn_add(p, p, t1);
bn_mul(t1, t0, t0);
bn_mul(t1, t1, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
bn_mul(t0, t0, t0);
bn_mul(t1, t0, t0);
bn_mul_dig(t1, t1, 36);
bn_add(p, p, t1);
fp_prime_set_dense(p);
break;
case B12_638:
fp_param_get_var(t0);
/* p = (x^2 - 2x + 1) * (x^4 - x^2 + 1)/3 + x. */
bn_sqr(t1, t0);
bn_sqr(p, t1);
bn_sub(p, p, t1);
bn_add_dig(p, p, 1);
bn_sub(t1, t1, t0);
bn_sub(t1, t1, t0);
bn_add_dig(t1, t1, 1);
bn_mul(p, p, t1);
bn_div_dig(p, p, 3);
bn_add(p, p, t0);
fp_prime_set_dense(p);
break;
#elif FP_PRIME == 1536
case SS_1536:
fp_param_get_var(t0);
bn_read_str(p, SS_P1536, strlen(SS_P1536), 16);
bn_mul(p, p, t0);
bn_dbl(p, p);
bn_sub_dig(p, p, 1);
fp_prime_set_dense(p);
break;
#else
default:
bn_gen_prime(p, FP_BITS);
fp_prime_set_dense(p);
core_get()->fp_id = 0;
break;
#endif
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(t0);
bn_free(t1);
bn_free(t2);
bn_free(p);
}
}
