Subversion Repositories Kolibri OS

Rev

Blame | Last modification | View Log | Download | RSS feed

  1. /*
  2.  *  Elliptic curves over GF(p): curve-specific data and functions
  3.  *
  4.  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5.  *  SPDX-License-Identifier: GPL-2.0
  6.  *
  7.  *  This program is free software; you can redistribute it and/or modify
  8.  *  it under the terms of the GNU General Public License as published by
  9.  *  the Free Software Foundation; either version 2 of the License, or
  10.  *  (at your option) any later version.
  11.  *
  12.  *  This program is distributed in the hope that it will be useful,
  13.  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14.  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15.  *  GNU General Public License for more details.
  16.  *
  17.  *  You should have received a copy of the GNU General Public License along
  18.  *  with this program; if not, write to the Free Software Foundation, Inc.,
  19.  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20.  *
  21.  *  This file is part of mbed TLS (https://tls.mbed.org)
  22.  */
  23.  
  24. #if !defined(MBEDTLS_CONFIG_FILE)
  25. #include "mbedtls/config.h"
  26. #else
  27. #include MBEDTLS_CONFIG_FILE
  28. #endif
  29.  
  30. #if defined(MBEDTLS_ECP_C)
  31.  
  32. #include "mbedtls/ecp.h"
  33. #include "mbedtls/platform_util.h"
  34.  
  35. #include <string.h>
  36.  
  37. #if !defined(MBEDTLS_ECP_ALT)
  38.  
  39. /* Parameter validation macros based on platform_util.h */
  40. #define ECP_VALIDATE_RET( cond )    \
  41.     MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
  42. #define ECP_VALIDATE( cond )        \
  43.     MBEDTLS_INTERNAL_VALIDATE( cond )
  44.  
  45. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  46.     !defined(inline) && !defined(__cplusplus)
  47. #define inline __inline
  48. #endif
  49.  
  50. /*
  51.  * Conversion macros for embedded constants:
  52.  * build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2
  53.  */
  54. #if defined(MBEDTLS_HAVE_INT32)
  55.  
  56. #define BYTES_TO_T_UINT_4( a, b, c, d )                       \
  57.     ( (mbedtls_mpi_uint) (a) <<  0 ) |                        \
  58.     ( (mbedtls_mpi_uint) (b) <<  8 ) |                        \
  59.     ( (mbedtls_mpi_uint) (c) << 16 ) |                        \
  60.     ( (mbedtls_mpi_uint) (d) << 24 )
  61.  
  62. #define BYTES_TO_T_UINT_2( a, b )                   \
  63.     BYTES_TO_T_UINT_4( a, b, 0, 0 )
  64.  
  65. #define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
  66.     BYTES_TO_T_UINT_4( a, b, c, d ),                \
  67.     BYTES_TO_T_UINT_4( e, f, g, h )
  68.  
  69. #else /* 64-bits */
  70.  
  71. #define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
  72.     ( (mbedtls_mpi_uint) (a) <<  0 ) |                        \
  73.     ( (mbedtls_mpi_uint) (b) <<  8 ) |                        \
  74.     ( (mbedtls_mpi_uint) (c) << 16 ) |                        \
  75.     ( (mbedtls_mpi_uint) (d) << 24 ) |                        \
  76.     ( (mbedtls_mpi_uint) (e) << 32 ) |                        \
  77.     ( (mbedtls_mpi_uint) (f) << 40 ) |                        \
  78.     ( (mbedtls_mpi_uint) (g) << 48 ) |                        \
  79.     ( (mbedtls_mpi_uint) (h) << 56 )
  80.  
  81. #define BYTES_TO_T_UINT_4( a, b, c, d )             \
  82.     BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 )
  83.  
  84. #define BYTES_TO_T_UINT_2( a, b )                   \
  85.     BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 )
  86.  
  87. #endif /* bits in mbedtls_mpi_uint */
  88.  
  89. /*
  90.  * Note: the constants are in little-endian order
  91.  * to be directly usable in MPIs
  92.  */
  93.  
  94. /*
  95.  * Domain parameters for secp192r1
  96.  */
  97. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  98. static const mbedtls_mpi_uint secp192r1_p[] = {
  99.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  100.     BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  101.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  102. };
  103. static const mbedtls_mpi_uint secp192r1_b[] = {
  104.     BYTES_TO_T_UINT_8( 0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE ),
  105.     BYTES_TO_T_UINT_8( 0x49, 0x30, 0x24, 0x72, 0xAB, 0xE9, 0xA7, 0x0F ),
  106.     BYTES_TO_T_UINT_8( 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64 ),
  107. };
  108. static const mbedtls_mpi_uint secp192r1_gx[] = {
  109.     BYTES_TO_T_UINT_8( 0x12, 0x10, 0xFF, 0x82, 0xFD, 0x0A, 0xFF, 0xF4 ),
  110.     BYTES_TO_T_UINT_8( 0x00, 0x88, 0xA1, 0x43, 0xEB, 0x20, 0xBF, 0x7C ),
  111.     BYTES_TO_T_UINT_8( 0xF6, 0x90, 0x30, 0xB0, 0x0E, 0xA8, 0x8D, 0x18 ),
  112. };
  113. static const mbedtls_mpi_uint secp192r1_gy[] = {
  114.     BYTES_TO_T_UINT_8( 0x11, 0x48, 0x79, 0x1E, 0xA1, 0x77, 0xF9, 0x73 ),
  115.     BYTES_TO_T_UINT_8( 0xD5, 0xCD, 0x24, 0x6B, 0xED, 0x11, 0x10, 0x63 ),
  116.     BYTES_TO_T_UINT_8( 0x78, 0xDA, 0xC8, 0xFF, 0x95, 0x2B, 0x19, 0x07 ),
  117. };
  118. static const mbedtls_mpi_uint secp192r1_n[] = {
  119.     BYTES_TO_T_UINT_8( 0x31, 0x28, 0xD2, 0xB4, 0xB1, 0xC9, 0x6B, 0x14 ),
  120.     BYTES_TO_T_UINT_8( 0x36, 0xF8, 0xDE, 0x99, 0xFF, 0xFF, 0xFF, 0xFF ),
  121.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  122. };
  123. #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
  124.  
  125. /*
  126.  * Domain parameters for secp224r1
  127.  */
  128. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  129. static const mbedtls_mpi_uint secp224r1_p[] = {
  130.     BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
  131.     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  132.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  133.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
  134. };
  135. static const mbedtls_mpi_uint secp224r1_b[] = {
  136.     BYTES_TO_T_UINT_8( 0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27 ),
  137.     BYTES_TO_T_UINT_8( 0xBA, 0xD8, 0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50 ),
  138.     BYTES_TO_T_UINT_8( 0x56, 0x32, 0x41, 0xF5, 0xAB, 0xB3, 0x04, 0x0C ),
  139.     BYTES_TO_T_UINT_4( 0x85, 0x0A, 0x05, 0xB4 ),
  140. };
  141. static const mbedtls_mpi_uint secp224r1_gx[] = {
  142.     BYTES_TO_T_UINT_8( 0x21, 0x1D, 0x5C, 0x11, 0xD6, 0x80, 0x32, 0x34 ),
  143.     BYTES_TO_T_UINT_8( 0x22, 0x11, 0xC2, 0x56, 0xD3, 0xC1, 0x03, 0x4A ),
  144.     BYTES_TO_T_UINT_8( 0xB9, 0x90, 0x13, 0x32, 0x7F, 0xBF, 0xB4, 0x6B ),
  145.     BYTES_TO_T_UINT_4( 0xBD, 0x0C, 0x0E, 0xB7 ),
  146. };
  147. static const mbedtls_mpi_uint secp224r1_gy[] = {
  148.     BYTES_TO_T_UINT_8( 0x34, 0x7E, 0x00, 0x85, 0x99, 0x81, 0xD5, 0x44 ),
  149.     BYTES_TO_T_UINT_8( 0x64, 0x47, 0x07, 0x5A, 0xA0, 0x75, 0x43, 0xCD ),
  150.     BYTES_TO_T_UINT_8( 0xE6, 0xDF, 0x22, 0x4C, 0xFB, 0x23, 0xF7, 0xB5 ),
  151.     BYTES_TO_T_UINT_4( 0x88, 0x63, 0x37, 0xBD ),
  152. };
  153. static const mbedtls_mpi_uint secp224r1_n[] = {
  154.     BYTES_TO_T_UINT_8( 0x3D, 0x2A, 0x5C, 0x5C, 0x45, 0x29, 0xDD, 0x13 ),
  155.     BYTES_TO_T_UINT_8( 0x3E, 0xF0, 0xB8, 0xE0, 0xA2, 0x16, 0xFF, 0xFF ),
  156.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  157.     BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
  158. };
  159. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
  160.  
  161. /*
  162.  * Domain parameters for secp256r1
  163.  */
  164. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  165. static const mbedtls_mpi_uint secp256r1_p[] = {
  166.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  167.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
  168.     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
  169.     BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  170. };
  171. static const mbedtls_mpi_uint secp256r1_b[] = {
  172.     BYTES_TO_T_UINT_8( 0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B ),
  173.     BYTES_TO_T_UINT_8( 0xF6, 0xB0, 0x53, 0xCC, 0xB0, 0x06, 0x1D, 0x65 ),
  174.     BYTES_TO_T_UINT_8( 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD, 0xEB, 0xB3 ),
  175.     BYTES_TO_T_UINT_8( 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A ),
  176. };
  177. static const mbedtls_mpi_uint secp256r1_gx[] = {
  178.     BYTES_TO_T_UINT_8( 0x96, 0xC2, 0x98, 0xD8, 0x45, 0x39, 0xA1, 0xF4 ),
  179.     BYTES_TO_T_UINT_8( 0xA0, 0x33, 0xEB, 0x2D, 0x81, 0x7D, 0x03, 0x77 ),
  180.     BYTES_TO_T_UINT_8( 0xF2, 0x40, 0xA4, 0x63, 0xE5, 0xE6, 0xBC, 0xF8 ),
  181.     BYTES_TO_T_UINT_8( 0x47, 0x42, 0x2C, 0xE1, 0xF2, 0xD1, 0x17, 0x6B ),
  182. };
  183. static const mbedtls_mpi_uint secp256r1_gy[] = {
  184.     BYTES_TO_T_UINT_8( 0xF5, 0x51, 0xBF, 0x37, 0x68, 0x40, 0xB6, 0xCB ),
  185.     BYTES_TO_T_UINT_8( 0xCE, 0x5E, 0x31, 0x6B, 0x57, 0x33, 0xCE, 0x2B ),
  186.     BYTES_TO_T_UINT_8( 0x16, 0x9E, 0x0F, 0x7C, 0x4A, 0xEB, 0xE7, 0x8E ),
  187.     BYTES_TO_T_UINT_8( 0x9B, 0x7F, 0x1A, 0xFE, 0xE2, 0x42, 0xE3, 0x4F ),
  188. };
  189. static const mbedtls_mpi_uint secp256r1_n[] = {
  190.     BYTES_TO_T_UINT_8( 0x51, 0x25, 0x63, 0xFC, 0xC2, 0xCA, 0xB9, 0xF3 ),
  191.     BYTES_TO_T_UINT_8( 0x84, 0x9E, 0x17, 0xA7, 0xAD, 0xFA, 0xE6, 0xBC ),
  192.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  193.     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  194. };
  195. #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
  196.  
  197. /*
  198.  * Domain parameters for secp384r1
  199.  */
  200. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  201. static const mbedtls_mpi_uint secp384r1_p[] = {
  202.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
  203.     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  204.     BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  205.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  206.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  207.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  208. };
  209. static const mbedtls_mpi_uint secp384r1_b[] = {
  210.     BYTES_TO_T_UINT_8( 0xEF, 0x2A, 0xEC, 0xD3, 0xED, 0xC8, 0x85, 0x2A ),
  211.     BYTES_TO_T_UINT_8( 0x9D, 0xD1, 0x2E, 0x8A, 0x8D, 0x39, 0x56, 0xC6 ),
  212.     BYTES_TO_T_UINT_8( 0x5A, 0x87, 0x13, 0x50, 0x8F, 0x08, 0x14, 0x03 ),
  213.     BYTES_TO_T_UINT_8( 0x12, 0x41, 0x81, 0xFE, 0x6E, 0x9C, 0x1D, 0x18 ),
  214.     BYTES_TO_T_UINT_8( 0x19, 0x2D, 0xF8, 0xE3, 0x6B, 0x05, 0x8E, 0x98 ),
  215.     BYTES_TO_T_UINT_8( 0xE4, 0xE7, 0x3E, 0xE2, 0xA7, 0x2F, 0x31, 0xB3 ),
  216. };
  217. static const mbedtls_mpi_uint secp384r1_gx[] = {
  218.     BYTES_TO_T_UINT_8( 0xB7, 0x0A, 0x76, 0x72, 0x38, 0x5E, 0x54, 0x3A ),
  219.     BYTES_TO_T_UINT_8( 0x6C, 0x29, 0x55, 0xBF, 0x5D, 0xF2, 0x02, 0x55 ),
  220.     BYTES_TO_T_UINT_8( 0x38, 0x2A, 0x54, 0x82, 0xE0, 0x41, 0xF7, 0x59 ),
  221.     BYTES_TO_T_UINT_8( 0x98, 0x9B, 0xA7, 0x8B, 0x62, 0x3B, 0x1D, 0x6E ),
  222.     BYTES_TO_T_UINT_8( 0x74, 0xAD, 0x20, 0xF3, 0x1E, 0xC7, 0xB1, 0x8E ),
  223.     BYTES_TO_T_UINT_8( 0x37, 0x05, 0x8B, 0xBE, 0x22, 0xCA, 0x87, 0xAA ),
  224. };
  225. static const mbedtls_mpi_uint secp384r1_gy[] = {
  226.     BYTES_TO_T_UINT_8( 0x5F, 0x0E, 0xEA, 0x90, 0x7C, 0x1D, 0x43, 0x7A ),
  227.     BYTES_TO_T_UINT_8( 0x9D, 0x81, 0x7E, 0x1D, 0xCE, 0xB1, 0x60, 0x0A ),
  228.     BYTES_TO_T_UINT_8( 0xC0, 0xB8, 0xF0, 0xB5, 0x13, 0x31, 0xDA, 0xE9 ),
  229.     BYTES_TO_T_UINT_8( 0x7C, 0x14, 0x9A, 0x28, 0xBD, 0x1D, 0xF4, 0xF8 ),
  230.     BYTES_TO_T_UINT_8( 0x29, 0xDC, 0x92, 0x92, 0xBF, 0x98, 0x9E, 0x5D ),
  231.     BYTES_TO_T_UINT_8( 0x6F, 0x2C, 0x26, 0x96, 0x4A, 0xDE, 0x17, 0x36 ),
  232. };
  233. static const mbedtls_mpi_uint secp384r1_n[] = {
  234.     BYTES_TO_T_UINT_8( 0x73, 0x29, 0xC5, 0xCC, 0x6A, 0x19, 0xEC, 0xEC ),
  235.     BYTES_TO_T_UINT_8( 0x7A, 0xA7, 0xB0, 0x48, 0xB2, 0x0D, 0x1A, 0x58 ),
  236.     BYTES_TO_T_UINT_8( 0xDF, 0x2D, 0x37, 0xF4, 0x81, 0x4D, 0x63, 0xC7 ),
  237.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  238.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  239.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  240. };
  241. #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  242.  
  243. /*
  244.  * Domain parameters for secp521r1
  245.  */
  246. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  247. static const mbedtls_mpi_uint secp521r1_p[] = {
  248.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  249.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  250.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  251.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  252.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  253.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  254.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  255.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  256.     BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
  257. };
  258. static const mbedtls_mpi_uint secp521r1_b[] = {
  259.     BYTES_TO_T_UINT_8( 0x00, 0x3F, 0x50, 0x6B, 0xD4, 0x1F, 0x45, 0xEF ),
  260.     BYTES_TO_T_UINT_8( 0xF1, 0x34, 0x2C, 0x3D, 0x88, 0xDF, 0x73, 0x35 ),
  261.     BYTES_TO_T_UINT_8( 0x07, 0xBF, 0xB1, 0x3B, 0xBD, 0xC0, 0x52, 0x16 ),
  262.     BYTES_TO_T_UINT_8( 0x7B, 0x93, 0x7E, 0xEC, 0x51, 0x39, 0x19, 0x56 ),
  263.     BYTES_TO_T_UINT_8( 0xE1, 0x09, 0xF1, 0x8E, 0x91, 0x89, 0xB4, 0xB8 ),
  264.     BYTES_TO_T_UINT_8( 0xF3, 0x15, 0xB3, 0x99, 0x5B, 0x72, 0xDA, 0xA2 ),
  265.     BYTES_TO_T_UINT_8( 0xEE, 0x40, 0x85, 0xB6, 0xA0, 0x21, 0x9A, 0x92 ),
  266.     BYTES_TO_T_UINT_8( 0x1F, 0x9A, 0x1C, 0x8E, 0x61, 0xB9, 0x3E, 0x95 ),
  267.     BYTES_TO_T_UINT_2( 0x51, 0x00 ),
  268. };
  269. static const mbedtls_mpi_uint secp521r1_gx[] = {
  270.     BYTES_TO_T_UINT_8( 0x66, 0xBD, 0xE5, 0xC2, 0x31, 0x7E, 0x7E, 0xF9 ),
  271.     BYTES_TO_T_UINT_8( 0x9B, 0x42, 0x6A, 0x85, 0xC1, 0xB3, 0x48, 0x33 ),
  272.     BYTES_TO_T_UINT_8( 0xDE, 0xA8, 0xFF, 0xA2, 0x27, 0xC1, 0x1D, 0xFE ),
  273.     BYTES_TO_T_UINT_8( 0x28, 0x59, 0xE7, 0xEF, 0x77, 0x5E, 0x4B, 0xA1 ),
  274.     BYTES_TO_T_UINT_8( 0xBA, 0x3D, 0x4D, 0x6B, 0x60, 0xAF, 0x28, 0xF8 ),
  275.     BYTES_TO_T_UINT_8( 0x21, 0xB5, 0x3F, 0x05, 0x39, 0x81, 0x64, 0x9C ),
  276.     BYTES_TO_T_UINT_8( 0x42, 0xB4, 0x95, 0x23, 0x66, 0xCB, 0x3E, 0x9E ),
  277.     BYTES_TO_T_UINT_8( 0xCD, 0xE9, 0x04, 0x04, 0xB7, 0x06, 0x8E, 0x85 ),
  278.     BYTES_TO_T_UINT_2( 0xC6, 0x00 ),
  279. };
  280. static const mbedtls_mpi_uint secp521r1_gy[] = {
  281.     BYTES_TO_T_UINT_8( 0x50, 0x66, 0xD1, 0x9F, 0x76, 0x94, 0xBE, 0x88 ),
  282.     BYTES_TO_T_UINT_8( 0x40, 0xC2, 0x72, 0xA2, 0x86, 0x70, 0x3C, 0x35 ),
  283.     BYTES_TO_T_UINT_8( 0x61, 0x07, 0xAD, 0x3F, 0x01, 0xB9, 0x50, 0xC5 ),
  284.     BYTES_TO_T_UINT_8( 0x40, 0x26, 0xF4, 0x5E, 0x99, 0x72, 0xEE, 0x97 ),
  285.     BYTES_TO_T_UINT_8( 0x2C, 0x66, 0x3E, 0x27, 0x17, 0xBD, 0xAF, 0x17 ),
  286.     BYTES_TO_T_UINT_8( 0x68, 0x44, 0x9B, 0x57, 0x49, 0x44, 0xF5, 0x98 ),
  287.     BYTES_TO_T_UINT_8( 0xD9, 0x1B, 0x7D, 0x2C, 0xB4, 0x5F, 0x8A, 0x5C ),
  288.     BYTES_TO_T_UINT_8( 0x04, 0xC0, 0x3B, 0x9A, 0x78, 0x6A, 0x29, 0x39 ),
  289.     BYTES_TO_T_UINT_2( 0x18, 0x01 ),
  290. };
  291. static const mbedtls_mpi_uint secp521r1_n[] = {
  292.     BYTES_TO_T_UINT_8( 0x09, 0x64, 0x38, 0x91, 0x1E, 0xB7, 0x6F, 0xBB ),
  293.     BYTES_TO_T_UINT_8( 0xAE, 0x47, 0x9C, 0x89, 0xB8, 0xC9, 0xB5, 0x3B ),
  294.     BYTES_TO_T_UINT_8( 0xD0, 0xA5, 0x09, 0xF7, 0x48, 0x01, 0xCC, 0x7F ),
  295.     BYTES_TO_T_UINT_8( 0x6B, 0x96, 0x2F, 0xBF, 0x83, 0x87, 0x86, 0x51 ),
  296.     BYTES_TO_T_UINT_8( 0xFA, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  297.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  298.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  299.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  300.     BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
  301. };
  302. #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
  303.  
  304. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  305. static const mbedtls_mpi_uint secp192k1_p[] = {
  306.     BYTES_TO_T_UINT_8( 0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
  307.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  308.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  309. };
  310. static const mbedtls_mpi_uint secp192k1_a[] = {
  311.     BYTES_TO_T_UINT_2( 0x00, 0x00 ),
  312. };
  313. static const mbedtls_mpi_uint secp192k1_b[] = {
  314.     BYTES_TO_T_UINT_2( 0x03, 0x00 ),
  315. };
  316. static const mbedtls_mpi_uint secp192k1_gx[] = {
  317.     BYTES_TO_T_UINT_8( 0x7D, 0x6C, 0xE0, 0xEA, 0xB1, 0xD1, 0xA5, 0x1D ),
  318.     BYTES_TO_T_UINT_8( 0x34, 0xF4, 0xB7, 0x80, 0x02, 0x7D, 0xB0, 0x26 ),
  319.     BYTES_TO_T_UINT_8( 0xAE, 0xE9, 0x57, 0xC0, 0x0E, 0xF1, 0x4F, 0xDB ),
  320. };
  321. static const mbedtls_mpi_uint secp192k1_gy[] = {
  322.     BYTES_TO_T_UINT_8( 0x9D, 0x2F, 0x5E, 0xD9, 0x88, 0xAA, 0x82, 0x40 ),
  323.     BYTES_TO_T_UINT_8( 0x34, 0x86, 0xBE, 0x15, 0xD0, 0x63, 0x41, 0x84 ),
  324.     BYTES_TO_T_UINT_8( 0xA7, 0x28, 0x56, 0x9C, 0x6D, 0x2F, 0x2F, 0x9B ),
  325. };
  326. static const mbedtls_mpi_uint secp192k1_n[] = {
  327.     BYTES_TO_T_UINT_8( 0x8D, 0xFD, 0xDE, 0x74, 0x6A, 0x46, 0x69, 0x0F ),
  328.     BYTES_TO_T_UINT_8( 0x17, 0xFC, 0xF2, 0x26, 0xFE, 0xFF, 0xFF, 0xFF ),
  329.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  330. };
  331. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
  332.  
  333. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  334. static const mbedtls_mpi_uint secp224k1_p[] = {
  335.     BYTES_TO_T_UINT_8( 0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
  336.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  337.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  338.     BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
  339. };
  340. static const mbedtls_mpi_uint secp224k1_a[] = {
  341.     BYTES_TO_T_UINT_2( 0x00, 0x00 ),
  342. };
  343. static const mbedtls_mpi_uint secp224k1_b[] = {
  344.     BYTES_TO_T_UINT_2( 0x05, 0x00 ),
  345. };
  346. static const mbedtls_mpi_uint secp224k1_gx[] = {
  347.     BYTES_TO_T_UINT_8( 0x5C, 0xA4, 0xB7, 0xB6, 0x0E, 0x65, 0x7E, 0x0F ),
  348.     BYTES_TO_T_UINT_8( 0xA9, 0x75, 0x70, 0xE4, 0xE9, 0x67, 0xA4, 0x69 ),
  349.     BYTES_TO_T_UINT_8( 0xA1, 0x28, 0xFC, 0x30, 0xDF, 0x99, 0xF0, 0x4D ),
  350.     BYTES_TO_T_UINT_4( 0x33, 0x5B, 0x45, 0xA1 ),
  351. };
  352. static const mbedtls_mpi_uint secp224k1_gy[] = {
  353.     BYTES_TO_T_UINT_8( 0xA5, 0x61, 0x6D, 0x55, 0xDB, 0x4B, 0xCA, 0xE2 ),
  354.     BYTES_TO_T_UINT_8( 0x59, 0xBD, 0xB0, 0xC0, 0xF7, 0x19, 0xE3, 0xF7 ),
  355.     BYTES_TO_T_UINT_8( 0xD6, 0xFB, 0xCA, 0x82, 0x42, 0x34, 0xBA, 0x7F ),
  356.     BYTES_TO_T_UINT_4( 0xED, 0x9F, 0x08, 0x7E ),
  357. };
  358. static const mbedtls_mpi_uint secp224k1_n[] = {
  359.     BYTES_TO_T_UINT_8( 0xF7, 0xB1, 0x9F, 0x76, 0x71, 0xA9, 0xF0, 0xCA ),
  360.     BYTES_TO_T_UINT_8( 0x84, 0x61, 0xEC, 0xD2, 0xE8, 0xDC, 0x01, 0x00 ),
  361.     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
  362.     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ),
  363. };
  364. #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
  365.  
  366. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  367. static const mbedtls_mpi_uint secp256k1_p[] = {
  368.     BYTES_TO_T_UINT_8( 0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
  369.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  370.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  371.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  372. };
  373. static const mbedtls_mpi_uint secp256k1_a[] = {
  374.     BYTES_TO_T_UINT_2( 0x00, 0x00 ),
  375. };
  376. static const mbedtls_mpi_uint secp256k1_b[] = {
  377.     BYTES_TO_T_UINT_2( 0x07, 0x00 ),
  378. };
  379. static const mbedtls_mpi_uint secp256k1_gx[] = {
  380.     BYTES_TO_T_UINT_8( 0x98, 0x17, 0xF8, 0x16, 0x5B, 0x81, 0xF2, 0x59 ),
  381.     BYTES_TO_T_UINT_8( 0xD9, 0x28, 0xCE, 0x2D, 0xDB, 0xFC, 0x9B, 0x02 ),
  382.     BYTES_TO_T_UINT_8( 0x07, 0x0B, 0x87, 0xCE, 0x95, 0x62, 0xA0, 0x55 ),
  383.     BYTES_TO_T_UINT_8( 0xAC, 0xBB, 0xDC, 0xF9, 0x7E, 0x66, 0xBE, 0x79 ),
  384. };
  385. static const mbedtls_mpi_uint secp256k1_gy[] = {
  386.     BYTES_TO_T_UINT_8( 0xB8, 0xD4, 0x10, 0xFB, 0x8F, 0xD0, 0x47, 0x9C ),
  387.     BYTES_TO_T_UINT_8( 0x19, 0x54, 0x85, 0xA6, 0x48, 0xB4, 0x17, 0xFD ),
  388.     BYTES_TO_T_UINT_8( 0xA8, 0x08, 0x11, 0x0E, 0xFC, 0xFB, 0xA4, 0x5D ),
  389.     BYTES_TO_T_UINT_8( 0x65, 0xC4, 0xA3, 0x26, 0x77, 0xDA, 0x3A, 0x48 ),
  390. };
  391. static const mbedtls_mpi_uint secp256k1_n[] = {
  392.     BYTES_TO_T_UINT_8( 0x41, 0x41, 0x36, 0xD0, 0x8C, 0x5E, 0xD2, 0xBF ),
  393.     BYTES_TO_T_UINT_8( 0x3B, 0xA0, 0x48, 0xAF, 0xE6, 0xDC, 0xAE, 0xBA ),
  394.     BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  395.     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  396. };
  397. #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
  398.  
  399. /*
  400.  * Domain parameters for brainpoolP256r1 (RFC 5639 3.4)
  401.  */
  402. #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
  403. static const mbedtls_mpi_uint brainpoolP256r1_p[] = {
  404.     BYTES_TO_T_UINT_8( 0x77, 0x53, 0x6E, 0x1F, 0x1D, 0x48, 0x13, 0x20 ),
  405.     BYTES_TO_T_UINT_8( 0x28, 0x20, 0x26, 0xD5, 0x23, 0xF6, 0x3B, 0x6E ),
  406.     BYTES_TO_T_UINT_8( 0x72, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
  407.     BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
  408. };
  409. static const mbedtls_mpi_uint brainpoolP256r1_a[] = {
  410.     BYTES_TO_T_UINT_8( 0xD9, 0xB5, 0x30, 0xF3, 0x44, 0x4B, 0x4A, 0xE9 ),
  411.     BYTES_TO_T_UINT_8( 0x6C, 0x5C, 0xDC, 0x26, 0xC1, 0x55, 0x80, 0xFB ),
  412.     BYTES_TO_T_UINT_8( 0xE7, 0xFF, 0x7A, 0x41, 0x30, 0x75, 0xF6, 0xEE ),
  413.     BYTES_TO_T_UINT_8( 0x57, 0x30, 0x2C, 0xFC, 0x75, 0x09, 0x5A, 0x7D ),
  414. };
  415. static const mbedtls_mpi_uint brainpoolP256r1_b[] = {
  416.     BYTES_TO_T_UINT_8( 0xB6, 0x07, 0x8C, 0xFF, 0x18, 0xDC, 0xCC, 0x6B ),
  417.     BYTES_TO_T_UINT_8( 0xCE, 0xE1, 0xF7, 0x5C, 0x29, 0x16, 0x84, 0x95 ),
  418.     BYTES_TO_T_UINT_8( 0xBF, 0x7C, 0xD7, 0xBB, 0xD9, 0xB5, 0x30, 0xF3 ),
  419.     BYTES_TO_T_UINT_8( 0x44, 0x4B, 0x4A, 0xE9, 0x6C, 0x5C, 0xDC, 0x26 ),
  420. };
  421. static const mbedtls_mpi_uint brainpoolP256r1_gx[] = {
  422.     BYTES_TO_T_UINT_8( 0x62, 0x32, 0xCE, 0x9A, 0xBD, 0x53, 0x44, 0x3A ),
  423.     BYTES_TO_T_UINT_8( 0xC2, 0x23, 0xBD, 0xE3, 0xE1, 0x27, 0xDE, 0xB9 ),
  424.     BYTES_TO_T_UINT_8( 0xAF, 0xB7, 0x81, 0xFC, 0x2F, 0x48, 0x4B, 0x2C ),
  425.     BYTES_TO_T_UINT_8( 0xCB, 0x57, 0x7E, 0xCB, 0xB9, 0xAE, 0xD2, 0x8B ),
  426. };
  427. static const mbedtls_mpi_uint brainpoolP256r1_gy[] = {
  428.     BYTES_TO_T_UINT_8( 0x97, 0x69, 0x04, 0x2F, 0xC7, 0x54, 0x1D, 0x5C ),
  429.     BYTES_TO_T_UINT_8( 0x54, 0x8E, 0xED, 0x2D, 0x13, 0x45, 0x77, 0xC2 ),
  430.     BYTES_TO_T_UINT_8( 0xC9, 0x1D, 0x61, 0x14, 0x1A, 0x46, 0xF8, 0x97 ),
  431.     BYTES_TO_T_UINT_8( 0xFD, 0xC4, 0xDA, 0xC3, 0x35, 0xF8, 0x7E, 0x54 ),
  432. };
  433. static const mbedtls_mpi_uint brainpoolP256r1_n[] = {
  434.     BYTES_TO_T_UINT_8( 0xA7, 0x56, 0x48, 0x97, 0x82, 0x0E, 0x1E, 0x90 ),
  435.     BYTES_TO_T_UINT_8( 0xF7, 0xA6, 0x61, 0xB5, 0xA3, 0x7A, 0x39, 0x8C ),
  436.     BYTES_TO_T_UINT_8( 0x71, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
  437.     BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
  438. };
  439. #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
  440.  
  441. /*
  442.  * Domain parameters for brainpoolP384r1 (RFC 5639 3.6)
  443.  */
  444. #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
  445. static const mbedtls_mpi_uint brainpoolP384r1_p[] = {
  446.     BYTES_TO_T_UINT_8( 0x53, 0xEC, 0x07, 0x31, 0x13, 0x00, 0x47, 0x87 ),
  447.     BYTES_TO_T_UINT_8( 0x71, 0x1A, 0x1D, 0x90, 0x29, 0xA7, 0xD3, 0xAC ),
  448.     BYTES_TO_T_UINT_8( 0x23, 0x11, 0xB7, 0x7F, 0x19, 0xDA, 0xB1, 0x12 ),
  449.     BYTES_TO_T_UINT_8( 0xB4, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
  450.     BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
  451.     BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
  452. };
  453. static const mbedtls_mpi_uint brainpoolP384r1_a[] = {
  454.     BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
  455.     BYTES_TO_T_UINT_8( 0xEB, 0xD4, 0x3A, 0x50, 0x4A, 0x81, 0xA5, 0x8A ),
  456.     BYTES_TO_T_UINT_8( 0x0F, 0xF9, 0x91, 0xBA, 0xEF, 0x65, 0x91, 0x13 ),
  457.     BYTES_TO_T_UINT_8( 0x87, 0x27, 0xB2, 0x4F, 0x8E, 0xA2, 0xBE, 0xC2 ),
  458.     BYTES_TO_T_UINT_8( 0xA0, 0xAF, 0x05, 0xCE, 0x0A, 0x08, 0x72, 0x3C ),
  459.     BYTES_TO_T_UINT_8( 0x0C, 0x15, 0x8C, 0x3D, 0xC6, 0x82, 0xC3, 0x7B ),
  460. };
  461. static const mbedtls_mpi_uint brainpoolP384r1_b[] = {
  462.     BYTES_TO_T_UINT_8( 0x11, 0x4C, 0x50, 0xFA, 0x96, 0x86, 0xB7, 0x3A ),
  463.     BYTES_TO_T_UINT_8( 0x94, 0xC9, 0xDB, 0x95, 0x02, 0x39, 0xB4, 0x7C ),
  464.     BYTES_TO_T_UINT_8( 0xD5, 0x62, 0xEB, 0x3E, 0xA5, 0x0E, 0x88, 0x2E ),
  465.     BYTES_TO_T_UINT_8( 0xA6, 0xD2, 0xDC, 0x07, 0xE1, 0x7D, 0xB7, 0x2F ),
  466.     BYTES_TO_T_UINT_8( 0x7C, 0x44, 0xF0, 0x16, 0x54, 0xB5, 0x39, 0x8B ),
  467.     BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
  468. };
  469. static const mbedtls_mpi_uint brainpoolP384r1_gx[] = {
  470.     BYTES_TO_T_UINT_8( 0x1E, 0xAF, 0xD4, 0x47, 0xE2, 0xB2, 0x87, 0xEF ),
  471.     BYTES_TO_T_UINT_8( 0xAA, 0x46, 0xD6, 0x36, 0x34, 0xE0, 0x26, 0xE8 ),
  472.     BYTES_TO_T_UINT_8( 0xE8, 0x10, 0xBD, 0x0C, 0xFE, 0xCA, 0x7F, 0xDB ),
  473.     BYTES_TO_T_UINT_8( 0xE3, 0x4F, 0xF1, 0x7E, 0xE7, 0xA3, 0x47, 0x88 ),
  474.     BYTES_TO_T_UINT_8( 0x6B, 0x3F, 0xC1, 0xB7, 0x81, 0x3A, 0xA6, 0xA2 ),
  475.     BYTES_TO_T_UINT_8( 0xFF, 0x45, 0xCF, 0x68, 0xF0, 0x64, 0x1C, 0x1D ),
  476. };
  477. static const mbedtls_mpi_uint brainpoolP384r1_gy[] = {
  478.     BYTES_TO_T_UINT_8( 0x15, 0x53, 0x3C, 0x26, 0x41, 0x03, 0x82, 0x42 ),
  479.     BYTES_TO_T_UINT_8( 0x11, 0x81, 0x91, 0x77, 0x21, 0x46, 0x46, 0x0E ),
  480.     BYTES_TO_T_UINT_8( 0x28, 0x29, 0x91, 0xF9, 0x4F, 0x05, 0x9C, 0xE1 ),
  481.     BYTES_TO_T_UINT_8( 0x64, 0x58, 0xEC, 0xFE, 0x29, 0x0B, 0xB7, 0x62 ),
  482.     BYTES_TO_T_UINT_8( 0x52, 0xD5, 0xCF, 0x95, 0x8E, 0xEB, 0xB1, 0x5C ),
  483.     BYTES_TO_T_UINT_8( 0xA4, 0xC2, 0xF9, 0x20, 0x75, 0x1D, 0xBE, 0x8A ),
  484. };
  485. static const mbedtls_mpi_uint brainpoolP384r1_n[] = {
  486.     BYTES_TO_T_UINT_8( 0x65, 0x65, 0x04, 0xE9, 0x02, 0x32, 0x88, 0x3B ),
  487.     BYTES_TO_T_UINT_8( 0x10, 0xC3, 0x7F, 0x6B, 0xAF, 0xB6, 0x3A, 0xCF ),
  488.     BYTES_TO_T_UINT_8( 0xA7, 0x25, 0x04, 0xAC, 0x6C, 0x6E, 0x16, 0x1F ),
  489.     BYTES_TO_T_UINT_8( 0xB3, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
  490.     BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
  491.     BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
  492. };
  493. #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
  494.  
  495. /*
  496.  * Domain parameters for brainpoolP512r1 (RFC 5639 3.7)
  497.  */
  498. #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
  499. static const mbedtls_mpi_uint brainpoolP512r1_p[] = {
  500.     BYTES_TO_T_UINT_8( 0xF3, 0x48, 0x3A, 0x58, 0x56, 0x60, 0xAA, 0x28 ),
  501.     BYTES_TO_T_UINT_8( 0x85, 0xC6, 0x82, 0x2D, 0x2F, 0xFF, 0x81, 0x28 ),
  502.     BYTES_TO_T_UINT_8( 0xE6, 0x80, 0xA3, 0xE6, 0x2A, 0xA1, 0xCD, 0xAE ),
  503.     BYTES_TO_T_UINT_8( 0x42, 0x68, 0xC6, 0x9B, 0x00, 0x9B, 0x4D, 0x7D ),
  504.     BYTES_TO_T_UINT_8( 0x71, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
  505.     BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
  506.     BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
  507.     BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
  508. };
  509. static const mbedtls_mpi_uint brainpoolP512r1_a[] = {
  510.     BYTES_TO_T_UINT_8( 0xCA, 0x94, 0xFC, 0x77, 0x4D, 0xAC, 0xC1, 0xE7 ),
  511.     BYTES_TO_T_UINT_8( 0xB9, 0xC7, 0xF2, 0x2B, 0xA7, 0x17, 0x11, 0x7F ),
  512.     BYTES_TO_T_UINT_8( 0xB5, 0xC8, 0x9A, 0x8B, 0xC9, 0xF1, 0x2E, 0x0A ),
  513.     BYTES_TO_T_UINT_8( 0xA1, 0x3A, 0x25, 0xA8, 0x5A, 0x5D, 0xED, 0x2D ),
  514.     BYTES_TO_T_UINT_8( 0xBC, 0x63, 0x98, 0xEA, 0xCA, 0x41, 0x34, 0xA8 ),
  515.     BYTES_TO_T_UINT_8( 0x10, 0x16, 0xF9, 0x3D, 0x8D, 0xDD, 0xCB, 0x94 ),
  516.     BYTES_TO_T_UINT_8( 0xC5, 0x4C, 0x23, 0xAC, 0x45, 0x71, 0x32, 0xE2 ),
  517.     BYTES_TO_T_UINT_8( 0x89, 0x3B, 0x60, 0x8B, 0x31, 0xA3, 0x30, 0x78 ),
  518. };
  519. static const mbedtls_mpi_uint brainpoolP512r1_b[] = {
  520.     BYTES_TO_T_UINT_8( 0x23, 0xF7, 0x16, 0x80, 0x63, 0xBD, 0x09, 0x28 ),
  521.     BYTES_TO_T_UINT_8( 0xDD, 0xE5, 0xBA, 0x5E, 0xB7, 0x50, 0x40, 0x98 ),
  522.     BYTES_TO_T_UINT_8( 0x67, 0x3E, 0x08, 0xDC, 0xCA, 0x94, 0xFC, 0x77 ),
  523.     BYTES_TO_T_UINT_8( 0x4D, 0xAC, 0xC1, 0xE7, 0xB9, 0xC7, 0xF2, 0x2B ),
  524.     BYTES_TO_T_UINT_8( 0xA7, 0x17, 0x11, 0x7F, 0xB5, 0xC8, 0x9A, 0x8B ),
  525.     BYTES_TO_T_UINT_8( 0xC9, 0xF1, 0x2E, 0x0A, 0xA1, 0x3A, 0x25, 0xA8 ),
  526.     BYTES_TO_T_UINT_8( 0x5A, 0x5D, 0xED, 0x2D, 0xBC, 0x63, 0x98, 0xEA ),
  527.     BYTES_TO_T_UINT_8( 0xCA, 0x41, 0x34, 0xA8, 0x10, 0x16, 0xF9, 0x3D ),
  528. };
  529. static const mbedtls_mpi_uint brainpoolP512r1_gx[] = {
  530.     BYTES_TO_T_UINT_8( 0x22, 0xF8, 0xB9, 0xBC, 0x09, 0x22, 0x35, 0x8B ),
  531.     BYTES_TO_T_UINT_8( 0x68, 0x5E, 0x6A, 0x40, 0x47, 0x50, 0x6D, 0x7C ),
  532.     BYTES_TO_T_UINT_8( 0x5F, 0x7D, 0xB9, 0x93, 0x7B, 0x68, 0xD1, 0x50 ),
  533.     BYTES_TO_T_UINT_8( 0x8D, 0xD4, 0xD0, 0xE2, 0x78, 0x1F, 0x3B, 0xFF ),
  534.     BYTES_TO_T_UINT_8( 0x8E, 0x09, 0xD0, 0xF4, 0xEE, 0x62, 0x3B, 0xB4 ),
  535.     BYTES_TO_T_UINT_8( 0xC1, 0x16, 0xD9, 0xB5, 0x70, 0x9F, 0xED, 0x85 ),
  536.     BYTES_TO_T_UINT_8( 0x93, 0x6A, 0x4C, 0x9C, 0x2E, 0x32, 0x21, 0x5A ),
  537.     BYTES_TO_T_UINT_8( 0x64, 0xD9, 0x2E, 0xD8, 0xBD, 0xE4, 0xAE, 0x81 ),
  538. };
  539. static const mbedtls_mpi_uint brainpoolP512r1_gy[] = {
  540.     BYTES_TO_T_UINT_8( 0x92, 0x08, 0xD8, 0x3A, 0x0F, 0x1E, 0xCD, 0x78 ),
  541.     BYTES_TO_T_UINT_8( 0x06, 0x54, 0xF0, 0xA8, 0x2F, 0x2B, 0xCA, 0xD1 ),
  542.     BYTES_TO_T_UINT_8( 0xAE, 0x63, 0x27, 0x8A, 0xD8, 0x4B, 0xCA, 0x5B ),
  543.     BYTES_TO_T_UINT_8( 0x5E, 0x48, 0x5F, 0x4A, 0x49, 0xDE, 0xDC, 0xB2 ),
  544.     BYTES_TO_T_UINT_8( 0x11, 0x81, 0x1F, 0x88, 0x5B, 0xC5, 0x00, 0xA0 ),
  545.     BYTES_TO_T_UINT_8( 0x1A, 0x7B, 0xA5, 0x24, 0x00, 0xF7, 0x09, 0xF2 ),
  546.     BYTES_TO_T_UINT_8( 0xFD, 0x22, 0x78, 0xCF, 0xA9, 0xBF, 0xEA, 0xC0 ),
  547.     BYTES_TO_T_UINT_8( 0xEC, 0x32, 0x63, 0x56, 0x5D, 0x38, 0xDE, 0x7D ),
  548. };
  549. static const mbedtls_mpi_uint brainpoolP512r1_n[] = {
  550.     BYTES_TO_T_UINT_8( 0x69, 0x00, 0xA9, 0x9C, 0x82, 0x96, 0x87, 0xB5 ),
  551.     BYTES_TO_T_UINT_8( 0xDD, 0xDA, 0x5D, 0x08, 0x81, 0xD3, 0xB1, 0x1D ),
  552.     BYTES_TO_T_UINT_8( 0x47, 0x10, 0xAC, 0x7F, 0x19, 0x61, 0x86, 0x41 ),
  553.     BYTES_TO_T_UINT_8( 0x19, 0x26, 0xA9, 0x4C, 0x41, 0x5C, 0x3E, 0x55 ),
  554.     BYTES_TO_T_UINT_8( 0x70, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
  555.     BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
  556.     BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
  557.     BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
  558. };
  559. #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
  560.  
  561. /*
  562.  * Create an MPI from embedded constants
  563.  * (assumes len is an exact multiple of sizeof mbedtls_mpi_uint)
  564.  */
  565. static inline void ecp_mpi_load( mbedtls_mpi *X, const mbedtls_mpi_uint *p, size_t len )
  566. {
  567.     X->s = 1;
  568.     X->n = len / sizeof( mbedtls_mpi_uint );
  569.     X->p = (mbedtls_mpi_uint *) p;
  570. }
  571.  
  572. /*
  573.  * Set an MPI to static value 1
  574.  */
  575. static inline void ecp_mpi_set1( mbedtls_mpi *X )
  576. {
  577.     static mbedtls_mpi_uint one[] = { 1 };
  578.     X->s = 1;
  579.     X->n = 1;
  580.     X->p = one;
  581. }
  582.  
  583. /*
  584.  * Make group available from embedded constants
  585.  */
  586. static int ecp_group_load( mbedtls_ecp_group *grp,
  587.                            const mbedtls_mpi_uint *p,  size_t plen,
  588.                            const mbedtls_mpi_uint *a,  size_t alen,
  589.                            const mbedtls_mpi_uint *b,  size_t blen,
  590.                            const mbedtls_mpi_uint *gx, size_t gxlen,
  591.                            const mbedtls_mpi_uint *gy, size_t gylen,
  592.                            const mbedtls_mpi_uint *n,  size_t nlen)
  593. {
  594.     ecp_mpi_load( &grp->P, p, plen );
  595.     if( a != NULL )
  596.         ecp_mpi_load( &grp->A, a, alen );
  597.     ecp_mpi_load( &grp->B, b, blen );
  598.     ecp_mpi_load( &grp->N, n, nlen );
  599.  
  600.     ecp_mpi_load( &grp->G.X, gx, gxlen );
  601.     ecp_mpi_load( &grp->G.Y, gy, gylen );
  602.     ecp_mpi_set1( &grp->G.Z );
  603.  
  604.     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  605.     grp->nbits = mbedtls_mpi_bitlen( &grp->N );
  606.  
  607.     grp->h = 1;
  608.  
  609.     return( 0 );
  610. }
  611.  
  612. #if defined(MBEDTLS_ECP_NIST_OPTIM)
  613. /* Forward declarations */
  614. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  615. static int ecp_mod_p192( mbedtls_mpi * );
  616. #endif
  617. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  618. static int ecp_mod_p224( mbedtls_mpi * );
  619. #endif
  620. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  621. static int ecp_mod_p256( mbedtls_mpi * );
  622. #endif
  623. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  624. static int ecp_mod_p384( mbedtls_mpi * );
  625. #endif
  626. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  627. static int ecp_mod_p521( mbedtls_mpi * );
  628. #endif
  629.  
  630. #define NIST_MODP( P )      grp->modp = ecp_mod_ ## P;
  631. #else
  632. #define NIST_MODP( P )
  633. #endif /* MBEDTLS_ECP_NIST_OPTIM */
  634.  
  635. /* Additional forward declarations */
  636. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  637. static int ecp_mod_p255( mbedtls_mpi * );
  638. #endif
  639. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  640. static int ecp_mod_p448( mbedtls_mpi * );
  641. #endif
  642. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  643. static int ecp_mod_p192k1( mbedtls_mpi * );
  644. #endif
  645. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  646. static int ecp_mod_p224k1( mbedtls_mpi * );
  647. #endif
  648. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  649. static int ecp_mod_p256k1( mbedtls_mpi * );
  650. #endif
  651.  
  652. #define LOAD_GROUP_A( G )   ecp_group_load( grp,            \
  653.                             G ## _p,  sizeof( G ## _p  ),   \
  654.                             G ## _a,  sizeof( G ## _a  ),   \
  655.                             G ## _b,  sizeof( G ## _b  ),   \
  656.                             G ## _gx, sizeof( G ## _gx ),   \
  657.                             G ## _gy, sizeof( G ## _gy ),   \
  658.                             G ## _n,  sizeof( G ## _n  ) )
  659.  
  660. #define LOAD_GROUP( G )     ecp_group_load( grp,            \
  661.                             G ## _p,  sizeof( G ## _p  ),   \
  662.                             NULL,     0,                    \
  663.                             G ## _b,  sizeof( G ## _b  ),   \
  664.                             G ## _gx, sizeof( G ## _gx ),   \
  665.                             G ## _gy, sizeof( G ## _gy ),   \
  666.                             G ## _n,  sizeof( G ## _n  ) )
  667.  
  668. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  669. /*
  670.  * Specialized function for creating the Curve25519 group
  671.  */
  672. static int ecp_use_curve25519( mbedtls_ecp_group *grp )
  673. {
  674.     int ret;
  675.  
  676.     /* Actually ( A + 2 ) / 4 */
  677.     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->A, 16, "01DB42" ) );
  678.  
  679.     /* P = 2^255 - 19 */
  680.     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
  681.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 255 ) );
  682.     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 19 ) );
  683.     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  684.  
  685.     /* N = 2^252 + 27742317777372353535851937790883648493 */
  686.     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->N, 16,
  687.                                               "14DEF9DEA2F79CD65812631A5CF5D3ED" ) );
  688.     MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 252, 1 ) );
  689.  
  690.     /* Y intentionally not set, since we use x/z coordinates.
  691.      * This is used as a marker to identify Montgomery curves! */
  692.     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.X, 9 ) );
  693.     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.Z, 1 ) );
  694.     mbedtls_mpi_free( &grp->G.Y );
  695.  
  696.     /* Actually, the required msb for private keys */
  697.     grp->nbits = 254;
  698.  
  699. cleanup:
  700.     if( ret != 0 )
  701.         mbedtls_ecp_group_free( grp );
  702.  
  703.     return( ret );
  704. }
  705. #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
  706.  
  707. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  708. /*
  709.  * Specialized function for creating the Curve448 group
  710.  */
  711. static int ecp_use_curve448( mbedtls_ecp_group *grp )
  712. {
  713.     mbedtls_mpi Ns;
  714.     int ret;
  715.  
  716.     mbedtls_mpi_init( &Ns );
  717.  
  718.     /* Actually ( A + 2 ) / 4 */
  719.     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->A, 16, "98AA" ) );
  720.  
  721.     /* P = 2^448 - 2^224 - 1 */
  722.     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
  723.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 224 ) );
  724.     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 1 ) );
  725.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 224 ) );
  726.     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 1 ) );
  727.     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  728.  
  729.     /* Y intentionally not set, since we use x/z coordinates.
  730.      * This is used as a marker to identify Montgomery curves! */
  731.     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.X, 5 ) );
  732.     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.Z, 1 ) );
  733.     mbedtls_mpi_free( &grp->G.Y );
  734.  
  735.     /* N = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 */
  736.     MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 446, 1 ) );
  737.     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &Ns, 16,
  738.                                               "8335DC163BB124B65129C96FDE933D8D723A70AADC873D6D54A7BB0D" ) );
  739.     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &grp->N, &grp->N, &Ns ) );
  740.  
  741.     /* Actually, the required msb for private keys */
  742.     grp->nbits = 447;
  743.  
  744. cleanup:
  745.     mbedtls_mpi_free( &Ns );
  746.     if( ret != 0 )
  747.         mbedtls_ecp_group_free( grp );
  748.  
  749.     return( ret );
  750. }
  751. #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
  752.  
  753. /*
  754.  * Set a group using well-known domain parameters
  755.  */
  756. int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id )
  757. {
  758.     ECP_VALIDATE_RET( grp != NULL );
  759.     mbedtls_ecp_group_free( grp );
  760.  
  761.     grp->id = id;
  762.  
  763.     switch( id )
  764.     {
  765. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  766.         case MBEDTLS_ECP_DP_SECP192R1:
  767.             NIST_MODP( p192 );
  768.             return( LOAD_GROUP( secp192r1 ) );
  769. #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
  770.  
  771. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  772.         case MBEDTLS_ECP_DP_SECP224R1:
  773.             NIST_MODP( p224 );
  774.             return( LOAD_GROUP( secp224r1 ) );
  775. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
  776.  
  777. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  778.         case MBEDTLS_ECP_DP_SECP256R1:
  779.             NIST_MODP( p256 );
  780.             return( LOAD_GROUP( secp256r1 ) );
  781. #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
  782.  
  783. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  784.         case MBEDTLS_ECP_DP_SECP384R1:
  785.             NIST_MODP( p384 );
  786.             return( LOAD_GROUP( secp384r1 ) );
  787. #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  788.  
  789. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  790.         case MBEDTLS_ECP_DP_SECP521R1:
  791.             NIST_MODP( p521 );
  792.             return( LOAD_GROUP( secp521r1 ) );
  793. #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
  794.  
  795. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  796.         case MBEDTLS_ECP_DP_SECP192K1:
  797.             grp->modp = ecp_mod_p192k1;
  798.             return( LOAD_GROUP_A( secp192k1 ) );
  799. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
  800.  
  801. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  802.         case MBEDTLS_ECP_DP_SECP224K1:
  803.             grp->modp = ecp_mod_p224k1;
  804.             return( LOAD_GROUP_A( secp224k1 ) );
  805. #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
  806.  
  807. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  808.         case MBEDTLS_ECP_DP_SECP256K1:
  809.             grp->modp = ecp_mod_p256k1;
  810.             return( LOAD_GROUP_A( secp256k1 ) );
  811. #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
  812.  
  813. #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
  814.         case MBEDTLS_ECP_DP_BP256R1:
  815.             return( LOAD_GROUP_A( brainpoolP256r1 ) );
  816. #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
  817.  
  818. #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
  819.         case MBEDTLS_ECP_DP_BP384R1:
  820.             return( LOAD_GROUP_A( brainpoolP384r1 ) );
  821. #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
  822.  
  823. #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
  824.         case MBEDTLS_ECP_DP_BP512R1:
  825.             return( LOAD_GROUP_A( brainpoolP512r1 ) );
  826. #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
  827.  
  828. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  829.         case MBEDTLS_ECP_DP_CURVE25519:
  830.             grp->modp = ecp_mod_p255;
  831.             return( ecp_use_curve25519( grp ) );
  832. #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
  833.  
  834. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  835.         case MBEDTLS_ECP_DP_CURVE448:
  836.             grp->modp = ecp_mod_p448;
  837.             return( ecp_use_curve448( grp ) );
  838. #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
  839.  
  840.         default:
  841.             mbedtls_ecp_group_free( grp );
  842.             return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
  843.     }
  844. }
  845.  
  846. #if defined(MBEDTLS_ECP_NIST_OPTIM)
  847. /*
  848.  * Fast reduction modulo the primes used by the NIST curves.
  849.  *
  850.  * These functions are critical for speed, but not needed for correct
  851.  * operations. So, we make the choice to heavily rely on the internals of our
  852.  * bignum library, which creates a tight coupling between these functions and
  853.  * our MPI implementation.  However, the coupling between the ECP module and
  854.  * MPI remains loose, since these functions can be deactivated at will.
  855.  */
  856.  
  857. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  858. /*
  859.  * Compared to the way things are presented in FIPS 186-3 D.2,
  860.  * we proceed in columns, from right (least significant chunk) to left,
  861.  * adding chunks to N in place, and keeping a carry for the next chunk.
  862.  * This avoids moving things around in memory, and uselessly adding zeros,
  863.  * compared to the more straightforward, line-oriented approach.
  864.  *
  865.  * For this prime we need to handle data in chunks of 64 bits.
  866.  * Since this is always a multiple of our basic mbedtls_mpi_uint, we can
  867.  * use a mbedtls_mpi_uint * to designate such a chunk, and small loops to handle it.
  868.  */
  869.  
  870. /* Add 64-bit chunks (dst += src) and update carry */
  871. static inline void add64( mbedtls_mpi_uint *dst, mbedtls_mpi_uint *src, mbedtls_mpi_uint *carry )
  872. {
  873.     unsigned char i;
  874.     mbedtls_mpi_uint c = 0;
  875.     for( i = 0; i < 8 / sizeof( mbedtls_mpi_uint ); i++, dst++, src++ )
  876.     {
  877.         *dst += c;      c  = ( *dst < c );
  878.         *dst += *src;   c += ( *dst < *src );
  879.     }
  880.     *carry += c;
  881. }
  882.  
  883. /* Add carry to a 64-bit chunk and update carry */
  884. static inline void carry64( mbedtls_mpi_uint *dst, mbedtls_mpi_uint *carry )
  885. {
  886.     unsigned char i;
  887.     for( i = 0; i < 8 / sizeof( mbedtls_mpi_uint ); i++, dst++ )
  888.     {
  889.         *dst += *carry;
  890.         *carry  = ( *dst < *carry );
  891.     }
  892. }
  893.  
  894. #define WIDTH       8 / sizeof( mbedtls_mpi_uint )
  895. #define A( i )      N->p + (i) * WIDTH
  896. #define ADD( i )    add64( p, A( i ), &c )
  897. #define NEXT        p += WIDTH; carry64( p, &c )
  898. #define LAST        p += WIDTH; *p = c; while( ++p < end ) *p = 0
  899.  
  900. /*
  901.  * Fast quasi-reduction modulo p192 (FIPS 186-3 D.2.1)
  902.  */
  903. static int ecp_mod_p192( mbedtls_mpi *N )
  904. {
  905.     int ret;
  906.     mbedtls_mpi_uint c = 0;
  907.     mbedtls_mpi_uint *p, *end;
  908.  
  909.     /* Make sure we have enough blocks so that A(5) is legal */
  910.     MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, 6 * WIDTH ) );
  911.  
  912.     p = N->p;
  913.     end = p + N->n;
  914.  
  915.     ADD( 3 ); ADD( 5 );             NEXT; // A0 += A3 + A5
  916.     ADD( 3 ); ADD( 4 ); ADD( 5 );   NEXT; // A1 += A3 + A4 + A5
  917.     ADD( 4 ); ADD( 5 );             LAST; // A2 += A4 + A5
  918.  
  919. cleanup:
  920.     return( ret );
  921. }
  922.  
  923. #undef WIDTH
  924. #undef A
  925. #undef ADD
  926. #undef NEXT
  927. #undef LAST
  928. #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
  929.  
  930. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) ||   \
  931.     defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ||   \
  932.     defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  933. /*
  934.  * The reader is advised to first understand ecp_mod_p192() since the same
  935.  * general structure is used here, but with additional complications:
  936.  * (1) chunks of 32 bits, and (2) subtractions.
  937.  */
  938.  
  939. /*
  940.  * For these primes, we need to handle data in chunks of 32 bits.
  941.  * This makes it more complicated if we use 64 bits limbs in MPI,
  942.  * which prevents us from using a uniform access method as for p192.
  943.  *
  944.  * So, we define a mini abstraction layer to access 32 bit chunks,
  945.  * load them in 'cur' for work, and store them back from 'cur' when done.
  946.  *
  947.  * While at it, also define the size of N in terms of 32-bit chunks.
  948.  */
  949. #define LOAD32      cur = A( i );
  950.  
  951. #if defined(MBEDTLS_HAVE_INT32)  /* 32 bit */
  952.  
  953. #define MAX32       N->n
  954. #define A( j )      N->p[j]
  955. #define STORE32     N->p[i] = cur;
  956.  
  957. #else                               /* 64-bit */
  958.  
  959. #define MAX32       N->n * 2
  960. #define A( j ) (j) % 2 ? (uint32_t)( N->p[(j)/2] >> 32 ) : \
  961.                          (uint32_t)( N->p[(j)/2] )
  962. #define STORE32                                   \
  963.     if( i % 2 ) {                                 \
  964.         N->p[i/2] &= 0x00000000FFFFFFFF;          \
  965.         N->p[i/2] |= ((mbedtls_mpi_uint) cur) << 32;        \
  966.     } else {                                      \
  967.         N->p[i/2] &= 0xFFFFFFFF00000000;          \
  968.         N->p[i/2] |= (mbedtls_mpi_uint) cur;                \
  969.     }
  970.  
  971. #endif /* sizeof( mbedtls_mpi_uint ) */
  972.  
  973. /*
  974.  * Helpers for addition and subtraction of chunks, with signed carry.
  975.  */
  976. static inline void add32( uint32_t *dst, uint32_t src, signed char *carry )
  977. {
  978.     *dst += src;
  979.     *carry += ( *dst < src );
  980. }
  981.  
  982. static inline void sub32( uint32_t *dst, uint32_t src, signed char *carry )
  983. {
  984.     *carry -= ( *dst < src );
  985.     *dst -= src;
  986. }
  987.  
  988. #define ADD( j )    add32( &cur, A( j ), &c );
  989. #define SUB( j )    sub32( &cur, A( j ), &c );
  990.  
  991. /*
  992.  * Helpers for the main 'loop'
  993.  * (see fix_negative for the motivation of C)
  994.  */
  995. #define INIT( b )                                                       \
  996.     int ret;                                                            \
  997.     signed char c = 0, cc;                                              \
  998.     uint32_t cur;                                                       \
  999.     size_t i = 0, bits = (b);                                           \
  1000.     mbedtls_mpi C;                                                      \
  1001.     mbedtls_mpi_uint Cp[ (b) / 8 / sizeof( mbedtls_mpi_uint) + 1 ];     \
  1002.                                                                         \
  1003.     C.s = 1;                                                            \
  1004.     C.n = (b) / 8 / sizeof( mbedtls_mpi_uint) + 1;                      \
  1005.     C.p = Cp;                                                           \
  1006.     memset( Cp, 0, C.n * sizeof( mbedtls_mpi_uint ) );                  \
  1007.                                                                         \
  1008.     MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, (b) * 2 / 8 /                 \
  1009.                                        sizeof( mbedtls_mpi_uint ) ) );  \
  1010.     LOAD32;
  1011.  
  1012. #define NEXT                    \
  1013.     STORE32; i++; LOAD32;       \
  1014.     cc = c; c = 0;              \
  1015.     if( cc < 0 )                \
  1016.         sub32( &cur, -cc, &c ); \
  1017.     else                        \
  1018.         add32( &cur, cc, &c );  \
  1019.  
  1020. #define LAST                                    \
  1021.     STORE32; i++;                               \
  1022.     cur = c > 0 ? c : 0; STORE32;               \
  1023.     cur = 0; while( ++i < MAX32 ) { STORE32; }  \
  1024.     if( c < 0 ) fix_negative( N, c, &C, bits );
  1025.  
  1026. /*
  1027.  * If the result is negative, we get it in the form
  1028.  * c * 2^(bits + 32) + N, with c negative and N positive shorter than 'bits'
  1029.  */
  1030. static inline int fix_negative( mbedtls_mpi *N, signed char c, mbedtls_mpi *C, size_t bits )
  1031. {
  1032.     int ret;
  1033.  
  1034.     /* C = - c * 2^(bits + 32) */
  1035. #if !defined(MBEDTLS_HAVE_INT64)
  1036.     ((void) bits);
  1037. #else
  1038.     if( bits == 224 )
  1039.         C->p[ C->n - 1 ] = ((mbedtls_mpi_uint) -c) << 32;
  1040.     else
  1041. #endif
  1042.         C->p[ C->n - 1 ] = (mbedtls_mpi_uint) -c;
  1043.  
  1044.     /* N = - ( C - N ) */
  1045.     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, C, N ) );
  1046.     N->s = -1;
  1047.  
  1048. cleanup:
  1049.  
  1050.     return( ret );
  1051. }
  1052.  
  1053. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  1054. /*
  1055.  * Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
  1056.  */
  1057. static int ecp_mod_p224( mbedtls_mpi *N )
  1058. {
  1059.     INIT( 224 );
  1060.  
  1061.     SUB(  7 ); SUB( 11 );               NEXT; // A0 += -A7 - A11
  1062.     SUB(  8 ); SUB( 12 );               NEXT; // A1 += -A8 - A12
  1063.     SUB(  9 ); SUB( 13 );               NEXT; // A2 += -A9 - A13
  1064.     SUB( 10 ); ADD(  7 ); ADD( 11 );    NEXT; // A3 += -A10 + A7 + A11
  1065.     SUB( 11 ); ADD(  8 ); ADD( 12 );    NEXT; // A4 += -A11 + A8 + A12
  1066.     SUB( 12 ); ADD(  9 ); ADD( 13 );    NEXT; // A5 += -A12 + A9 + A13
  1067.     SUB( 13 ); ADD( 10 );               LAST; // A6 += -A13 + A10
  1068.  
  1069. cleanup:
  1070.     return( ret );
  1071. }
  1072. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
  1073.  
  1074. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  1075. /*
  1076.  * Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
  1077.  */
  1078. static int ecp_mod_p256( mbedtls_mpi *N )
  1079. {
  1080.     INIT( 256 );
  1081.  
  1082.     ADD(  8 ); ADD(  9 );
  1083.     SUB( 11 ); SUB( 12 ); SUB( 13 ); SUB( 14 );             NEXT; // A0
  1084.  
  1085.     ADD(  9 ); ADD( 10 );
  1086.     SUB( 12 ); SUB( 13 ); SUB( 14 ); SUB( 15 );             NEXT; // A1
  1087.  
  1088.     ADD( 10 ); ADD( 11 );
  1089.     SUB( 13 ); SUB( 14 ); SUB( 15 );                        NEXT; // A2
  1090.  
  1091.     ADD( 11 ); ADD( 11 ); ADD( 12 ); ADD( 12 ); ADD( 13 );
  1092.     SUB( 15 ); SUB(  8 ); SUB(  9 );                        NEXT; // A3
  1093.  
  1094.     ADD( 12 ); ADD( 12 ); ADD( 13 ); ADD( 13 ); ADD( 14 );
  1095.     SUB(  9 ); SUB( 10 );                                   NEXT; // A4
  1096.  
  1097.     ADD( 13 ); ADD( 13 ); ADD( 14 ); ADD( 14 ); ADD( 15 );
  1098.     SUB( 10 ); SUB( 11 );                                   NEXT; // A5
  1099.  
  1100.     ADD( 14 ); ADD( 14 ); ADD( 15 ); ADD( 15 ); ADD( 14 ); ADD( 13 );
  1101.     SUB(  8 ); SUB(  9 );                                   NEXT; // A6
  1102.  
  1103.     ADD( 15 ); ADD( 15 ); ADD( 15 ); ADD( 8 );
  1104.     SUB( 10 ); SUB( 11 ); SUB( 12 ); SUB( 13 );             LAST; // A7
  1105.  
  1106. cleanup:
  1107.     return( ret );
  1108. }
  1109. #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
  1110.  
  1111. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  1112. /*
  1113.  * Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4)
  1114.  */
  1115. static int ecp_mod_p384( mbedtls_mpi *N )
  1116. {
  1117.     INIT( 384 );
  1118.  
  1119.     ADD( 12 ); ADD( 21 ); ADD( 20 );
  1120.     SUB( 23 );                                              NEXT; // A0
  1121.  
  1122.     ADD( 13 ); ADD( 22 ); ADD( 23 );
  1123.     SUB( 12 ); SUB( 20 );                                   NEXT; // A2
  1124.  
  1125.     ADD( 14 ); ADD( 23 );
  1126.     SUB( 13 ); SUB( 21 );                                   NEXT; // A2
  1127.  
  1128.     ADD( 15 ); ADD( 12 ); ADD( 20 ); ADD( 21 );
  1129.     SUB( 14 ); SUB( 22 ); SUB( 23 );                        NEXT; // A3
  1130.  
  1131.     ADD( 21 ); ADD( 21 ); ADD( 16 ); ADD( 13 ); ADD( 12 ); ADD( 20 ); ADD( 22 );
  1132.     SUB( 15 ); SUB( 23 ); SUB( 23 );                        NEXT; // A4
  1133.  
  1134.     ADD( 22 ); ADD( 22 ); ADD( 17 ); ADD( 14 ); ADD( 13 ); ADD( 21 ); ADD( 23 );
  1135.     SUB( 16 );                                              NEXT; // A5
  1136.  
  1137.     ADD( 23 ); ADD( 23 ); ADD( 18 ); ADD( 15 ); ADD( 14 ); ADD( 22 );
  1138.     SUB( 17 );                                              NEXT; // A6
  1139.  
  1140.     ADD( 19 ); ADD( 16 ); ADD( 15 ); ADD( 23 );
  1141.     SUB( 18 );                                              NEXT; // A7
  1142.  
  1143.     ADD( 20 ); ADD( 17 ); ADD( 16 );
  1144.     SUB( 19 );                                              NEXT; // A8
  1145.  
  1146.     ADD( 21 ); ADD( 18 ); ADD( 17 );
  1147.     SUB( 20 );                                              NEXT; // A9
  1148.  
  1149.     ADD( 22 ); ADD( 19 ); ADD( 18 );
  1150.     SUB( 21 );                                              NEXT; // A10
  1151.  
  1152.     ADD( 23 ); ADD( 20 ); ADD( 19 );
  1153.     SUB( 22 );                                              LAST; // A11
  1154.  
  1155. cleanup:
  1156.     return( ret );
  1157. }
  1158. #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  1159.  
  1160. #undef A
  1161. #undef LOAD32
  1162. #undef STORE32
  1163. #undef MAX32
  1164. #undef INIT
  1165. #undef NEXT
  1166. #undef LAST
  1167.  
  1168. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
  1169.           MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
  1170.           MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  1171.  
  1172. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  1173. /*
  1174.  * Here we have an actual Mersenne prime, so things are more straightforward.
  1175.  * However, chunks are aligned on a 'weird' boundary (521 bits).
  1176.  */
  1177.  
  1178. /* Size of p521 in terms of mbedtls_mpi_uint */
  1179. #define P521_WIDTH      ( 521 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
  1180.  
  1181. /* Bits to keep in the most significant mbedtls_mpi_uint */
  1182. #define P521_MASK       0x01FF
  1183.  
  1184. /*
  1185.  * Fast quasi-reduction modulo p521 (FIPS 186-3 D.2.5)
  1186.  * Write N as A1 + 2^521 A0, return A0 + A1
  1187.  */
  1188. static int ecp_mod_p521( mbedtls_mpi *N )
  1189. {
  1190.     int ret;
  1191.     size_t i;
  1192.     mbedtls_mpi M;
  1193.     mbedtls_mpi_uint Mp[P521_WIDTH + 1];
  1194.     /* Worst case for the size of M is when mbedtls_mpi_uint is 16 bits:
  1195.      * we need to hold bits 513 to 1056, which is 34 limbs, that is
  1196.      * P521_WIDTH + 1. Otherwise P521_WIDTH is enough. */
  1197.  
  1198.     if( N->n < P521_WIDTH )
  1199.         return( 0 );
  1200.  
  1201.     /* M = A1 */
  1202.     M.s = 1;
  1203.     M.n = N->n - ( P521_WIDTH - 1 );
  1204.     if( M.n > P521_WIDTH + 1 )
  1205.         M.n = P521_WIDTH + 1;
  1206.     M.p = Mp;
  1207.     memcpy( Mp, N->p + P521_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
  1208.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 521 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
  1209.  
  1210.     /* N = A0 */
  1211.     N->p[P521_WIDTH - 1] &= P521_MASK;
  1212.     for( i = P521_WIDTH; i < N->n; i++ )
  1213.         N->p[i] = 0;
  1214.  
  1215.     /* N = A0 + A1 */
  1216.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1217.  
  1218. cleanup:
  1219.     return( ret );
  1220. }
  1221.  
  1222. #undef P521_WIDTH
  1223. #undef P521_MASK
  1224. #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
  1225.  
  1226. #endif /* MBEDTLS_ECP_NIST_OPTIM */
  1227.  
  1228. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  1229.  
  1230. /* Size of p255 in terms of mbedtls_mpi_uint */
  1231. #define P255_WIDTH      ( 255 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
  1232.  
  1233. /*
  1234.  * Fast quasi-reduction modulo p255 = 2^255 - 19
  1235.  * Write N as A0 + 2^255 A1, return A0 + 19 * A1
  1236.  */
  1237. static int ecp_mod_p255( mbedtls_mpi *N )
  1238. {
  1239.     int ret;
  1240.     size_t i;
  1241.     mbedtls_mpi M;
  1242.     mbedtls_mpi_uint Mp[P255_WIDTH + 2];
  1243.  
  1244.     if( N->n < P255_WIDTH )
  1245.         return( 0 );
  1246.  
  1247.     /* M = A1 */
  1248.     M.s = 1;
  1249.     M.n = N->n - ( P255_WIDTH - 1 );
  1250.     if( M.n > P255_WIDTH + 1 )
  1251.         return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
  1252.     M.p = Mp;
  1253.     memset( Mp, 0, sizeof Mp );
  1254.     memcpy( Mp, N->p + P255_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
  1255.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 255 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
  1256.     M.n++; /* Make room for multiplication by 19 */
  1257.  
  1258.     /* N = A0 */
  1259.     MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( N, 255, 0 ) );
  1260.     for( i = P255_WIDTH; i < N->n; i++ )
  1261.         N->p[i] = 0;
  1262.  
  1263.     /* N = A0 + 19 * A1 */
  1264.     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &M, 19 ) );
  1265.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1266.  
  1267. cleanup:
  1268.     return( ret );
  1269. }
  1270. #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
  1271.  
  1272. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  1273.  
  1274. /* Size of p448 in terms of mbedtls_mpi_uint */
  1275. #define P448_WIDTH      ( 448 / 8 / sizeof( mbedtls_mpi_uint ) )
  1276.  
  1277. /* Number of limbs fully occupied by 2^224 (max), and limbs used by it (min) */
  1278. #define DIV_ROUND_UP( X, Y ) ( ( ( X ) + ( Y ) - 1 ) / ( Y ) )
  1279. #define P224_WIDTH_MIN   ( 28 / sizeof( mbedtls_mpi_uint ) )
  1280. #define P224_WIDTH_MAX   DIV_ROUND_UP( 28, sizeof( mbedtls_mpi_uint ) )
  1281. #define P224_UNUSED_BITS ( ( P224_WIDTH_MAX * sizeof( mbedtls_mpi_uint ) * 8 ) - 224 )
  1282.  
  1283. /*
  1284.  * Fast quasi-reduction modulo p448 = 2^448 - 2^224 - 1
  1285.  * Write N as A0 + 2^448 A1 and A1 as B0 + 2^224 B1, and return
  1286.  * A0 + A1 + B1 + (B0 + B1) * 2^224.  This is different to the reference
  1287.  * implementation of Curve448, which uses its own special 56-bit limbs rather
  1288.  * than a generic bignum library.  We could squeeze some extra speed out on
  1289.  * 32-bit machines by splitting N up into 32-bit limbs and doing the
  1290.  * arithmetic using the limbs directly as we do for the NIST primes above,
  1291.  * but for 64-bit targets it should use half the number of operations if we do
  1292.  * the reduction with 224-bit limbs, since mpi_add_mpi will then use 64-bit adds.
  1293.  */
  1294. static int ecp_mod_p448( mbedtls_mpi *N )
  1295. {
  1296.     int ret;
  1297.     size_t i;
  1298.     mbedtls_mpi M, Q;
  1299.     mbedtls_mpi_uint Mp[P448_WIDTH + 1], Qp[P448_WIDTH];
  1300.  
  1301.     if( N->n <= P448_WIDTH )
  1302.         return( 0 );
  1303.  
  1304.     /* M = A1 */
  1305.     M.s = 1;
  1306.     M.n = N->n - ( P448_WIDTH );
  1307.     if( M.n > P448_WIDTH )
  1308.         /* Shouldn't be called with N larger than 2^896! */
  1309.         return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
  1310.     M.p = Mp;
  1311.     memset( Mp, 0, sizeof( Mp ) );
  1312.     memcpy( Mp, N->p + P448_WIDTH, M.n * sizeof( mbedtls_mpi_uint ) );
  1313.  
  1314.     /* N = A0 */
  1315.     for( i = P448_WIDTH; i < N->n; i++ )
  1316.         N->p[i] = 0;
  1317.  
  1318.     /* N += A1 */
  1319.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
  1320.  
  1321.     /* Q = B1, N += B1 */
  1322.     Q = M;
  1323.     Q.p = Qp;
  1324.     memcpy( Qp, Mp, sizeof( Qp ) );
  1325.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &Q, 224 ) );
  1326.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &Q ) );
  1327.  
  1328.     /* M = (B0 + B1) * 2^224, N += M */
  1329.     if( sizeof( mbedtls_mpi_uint ) > 4 )
  1330.         Mp[P224_WIDTH_MIN] &= ( (mbedtls_mpi_uint)-1 ) >> ( P224_UNUSED_BITS );
  1331.     for( i = P224_WIDTH_MAX; i < M.n; ++i )
  1332.         Mp[i] = 0;
  1333.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &M, &M, &Q ) );
  1334.     M.n = P448_WIDTH + 1; /* Make room for shifted carry bit from the addition */
  1335.     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &M, 224 ) );
  1336.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
  1337.  
  1338. cleanup:
  1339.     return( ret );
  1340. }
  1341. #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
  1342.  
  1343. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||   \
  1344.     defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||   \
  1345.     defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  1346. /*
  1347.  * Fast quasi-reduction modulo P = 2^s - R,
  1348.  * with R about 33 bits, used by the Koblitz curves.
  1349.  *
  1350.  * Write N as A0 + 2^224 A1, return A0 + R * A1.
  1351.  * Actually do two passes, since R is big.
  1352.  */
  1353. #define P_KOBLITZ_MAX   ( 256 / 8 / sizeof( mbedtls_mpi_uint ) )  // Max limbs in P
  1354. #define P_KOBLITZ_R     ( 8 / sizeof( mbedtls_mpi_uint ) )        // Limbs in R
  1355. static inline int ecp_mod_koblitz( mbedtls_mpi *N, mbedtls_mpi_uint *Rp, size_t p_limbs,
  1356.                                    size_t adjust, size_t shift, mbedtls_mpi_uint mask )
  1357. {
  1358.     int ret;
  1359.     size_t i;
  1360.     mbedtls_mpi M, R;
  1361.     mbedtls_mpi_uint Mp[P_KOBLITZ_MAX + P_KOBLITZ_R + 1];
  1362.  
  1363.     if( N->n < p_limbs )
  1364.         return( 0 );
  1365.  
  1366.     /* Init R */
  1367.     R.s = 1;
  1368.     R.p = Rp;
  1369.     R.n = P_KOBLITZ_R;
  1370.  
  1371.     /* Common setup for M */
  1372.     M.s = 1;
  1373.     M.p = Mp;
  1374.  
  1375.     /* M = A1 */
  1376.     M.n = N->n - ( p_limbs - adjust );
  1377.     if( M.n > p_limbs + adjust )
  1378.         M.n = p_limbs + adjust;
  1379.     memset( Mp, 0, sizeof Mp );
  1380.     memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
  1381.     if( shift != 0 )
  1382.         MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
  1383.     M.n += R.n; /* Make room for multiplication by R */
  1384.  
  1385.     /* N = A0 */
  1386.     if( mask != 0 )
  1387.         N->p[p_limbs - 1] &= mask;
  1388.     for( i = p_limbs; i < N->n; i++ )
  1389.         N->p[i] = 0;
  1390.  
  1391.     /* N = A0 + R * A1 */
  1392.     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &M, &M, &R ) );
  1393.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1394.  
  1395.     /* Second pass */
  1396.  
  1397.     /* M = A1 */
  1398.     M.n = N->n - ( p_limbs - adjust );
  1399.     if( M.n > p_limbs + adjust )
  1400.         M.n = p_limbs + adjust;
  1401.     memset( Mp, 0, sizeof Mp );
  1402.     memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
  1403.     if( shift != 0 )
  1404.         MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
  1405.     M.n += R.n; /* Make room for multiplication by R */
  1406.  
  1407.     /* N = A0 */
  1408.     if( mask != 0 )
  1409.         N->p[p_limbs - 1] &= mask;
  1410.     for( i = p_limbs; i < N->n; i++ )
  1411.         N->p[i] = 0;
  1412.  
  1413.     /* N = A0 + R * A1 */
  1414.     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &M, &M, &R ) );
  1415.     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1416.  
  1417. cleanup:
  1418.     return( ret );
  1419. }
  1420. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||
  1421.           MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||
  1422.           MBEDTLS_ECP_DP_SECP256K1_ENABLED) */
  1423.  
  1424. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  1425. /*
  1426.  * Fast quasi-reduction modulo p192k1 = 2^192 - R,
  1427.  * with R = 2^32 + 2^12 + 2^8 + 2^7 + 2^6 + 2^3 + 1 = 0x0100001119
  1428.  */
  1429. static int ecp_mod_p192k1( mbedtls_mpi *N )
  1430. {
  1431.     static mbedtls_mpi_uint Rp[] = {
  1432.         BYTES_TO_T_UINT_8( 0xC9, 0x11, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
  1433.  
  1434.     return( ecp_mod_koblitz( N, Rp, 192 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
  1435. }
  1436. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
  1437.  
  1438. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  1439. /*
  1440.  * Fast quasi-reduction modulo p224k1 = 2^224 - R,
  1441.  * with R = 2^32 + 2^12 + 2^11 + 2^9 + 2^7 + 2^4 + 2 + 1 = 0x0100001A93
  1442.  */
  1443. static int ecp_mod_p224k1( mbedtls_mpi *N )
  1444. {
  1445.     static mbedtls_mpi_uint Rp[] = {
  1446.         BYTES_TO_T_UINT_8( 0x93, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
  1447.  
  1448. #if defined(MBEDTLS_HAVE_INT64)
  1449.     return( ecp_mod_koblitz( N, Rp, 4, 1, 32, 0xFFFFFFFF ) );
  1450. #else
  1451.     return( ecp_mod_koblitz( N, Rp, 224 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
  1452. #endif
  1453. }
  1454.  
  1455. #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
  1456.  
  1457. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  1458. /*
  1459.  * Fast quasi-reduction modulo p256k1 = 2^256 - R,
  1460.  * with R = 2^32 + 2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1 = 0x01000003D1
  1461.  */
  1462. static int ecp_mod_p256k1( mbedtls_mpi *N )
  1463. {
  1464.     static mbedtls_mpi_uint Rp[] = {
  1465.         BYTES_TO_T_UINT_8( 0xD1, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
  1466.     return( ecp_mod_koblitz( N, Rp, 256 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
  1467. }
  1468. #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
  1469.  
  1470. #endif /* !MBEDTLS_ECP_ALT */
  1471.  
  1472. #endif /* MBEDTLS_ECP_C */
  1473.