1*f9fbec18Smcpowers /* 2*f9fbec18Smcpowers * ***** BEGIN LICENSE BLOCK ***** 3*f9fbec18Smcpowers * Version: MPL 1.1/GPL 2.0/LGPL 2.1 4*f9fbec18Smcpowers * 5*f9fbec18Smcpowers * The contents of this file are subject to the Mozilla Public License Version 6*f9fbec18Smcpowers * 1.1 (the "License"); you may not use this file except in compliance with 7*f9fbec18Smcpowers * the License. You may obtain a copy of the License at 8*f9fbec18Smcpowers * http://www.mozilla.org/MPL/ 9*f9fbec18Smcpowers * 10*f9fbec18Smcpowers * Software distributed under the License is distributed on an "AS IS" basis, 11*f9fbec18Smcpowers * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 12*f9fbec18Smcpowers * for the specific language governing rights and limitations under the 13*f9fbec18Smcpowers * License. 14*f9fbec18Smcpowers * 15*f9fbec18Smcpowers * The Original Code is the elliptic curve math library for binary polynomial field curves. 16*f9fbec18Smcpowers * 17*f9fbec18Smcpowers * The Initial Developer of the Original Code is 18*f9fbec18Smcpowers * Sun Microsystems, Inc. 19*f9fbec18Smcpowers * Portions created by the Initial Developer are Copyright (C) 2003 20*f9fbec18Smcpowers * the Initial Developer. All Rights Reserved. 21*f9fbec18Smcpowers * 22*f9fbec18Smcpowers * Contributor(s): 23*f9fbec18Smcpowers * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories 24*f9fbec18Smcpowers * 25*f9fbec18Smcpowers * Alternatively, the contents of this file may be used under the terms of 26*f9fbec18Smcpowers * either the GNU General Public License Version 2 or later (the "GPL"), or 27*f9fbec18Smcpowers * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), 28*f9fbec18Smcpowers * in which case the provisions of the GPL or the LGPL are applicable instead 29*f9fbec18Smcpowers * of those above. If you wish to allow use of your version of this file only 30*f9fbec18Smcpowers * under the terms of either the GPL or the LGPL, and not to allow others to 31*f9fbec18Smcpowers * use your version of this file under the terms of the MPL, indicate your 32*f9fbec18Smcpowers * decision by deleting the provisions above and replace them with the notice 33*f9fbec18Smcpowers * and other provisions required by the GPL or the LGPL. If you do not delete 34*f9fbec18Smcpowers * the provisions above, a recipient may use your version of this file under 35*f9fbec18Smcpowers * the terms of any one of the MPL, the GPL or the LGPL. 36*f9fbec18Smcpowers * 37*f9fbec18Smcpowers * ***** END LICENSE BLOCK ***** */ 38*f9fbec18Smcpowers /* 39*f9fbec18Smcpowers * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 40*f9fbec18Smcpowers * Use is subject to license terms. 41*f9fbec18Smcpowers * 42*f9fbec18Smcpowers * Sun elects to use this software under the MPL license. 43*f9fbec18Smcpowers */ 44*f9fbec18Smcpowers 45*f9fbec18Smcpowers #pragma ident "%Z%%M% %I% %E% SMI" 46*f9fbec18Smcpowers 47*f9fbec18Smcpowers #ifdef _KERNEL 48*f9fbec18Smcpowers #include <sys/types.h> 49*f9fbec18Smcpowers #include <sys/systm.h> 50*f9fbec18Smcpowers #include <sys/param.h> 51*f9fbec18Smcpowers #include <sys/modctl.h> 52*f9fbec18Smcpowers #include <sys/ddi.h> 53*f9fbec18Smcpowers #include <sys/crypto/spi.h> 54*f9fbec18Smcpowers #include <sys/sysmacros.h> 55*f9fbec18Smcpowers #include <sys/strsun.h> 56*f9fbec18Smcpowers #include <sys/md5.h> 57*f9fbec18Smcpowers #include <sys/sha1.h> 58*f9fbec18Smcpowers #include <sys/sha2.h> 59*f9fbec18Smcpowers #include <sys/random.h> 60*f9fbec18Smcpowers #include <sys/conf.h> 61*f9fbec18Smcpowers #include <sys/devops.h> 62*f9fbec18Smcpowers #include <sys/sunddi.h> 63*f9fbec18Smcpowers #include <sys/varargs.h> 64*f9fbec18Smcpowers #include <sys/kmem.h> 65*f9fbec18Smcpowers #include <sys/kstat.h> 66*f9fbec18Smcpowers #include <sys/crypto/common.h> 67*f9fbec18Smcpowers #else 68*f9fbec18Smcpowers #include <stdio.h> 69*f9fbec18Smcpowers #include <string.h> 70*f9fbec18Smcpowers #include <strings.h> 71*f9fbec18Smcpowers #include <assert.h> 72*f9fbec18Smcpowers #include <time.h> 73*f9fbec18Smcpowers #include <sys/time.h> 74*f9fbec18Smcpowers #include <sys/resource.h> 75*f9fbec18Smcpowers #endif /* _KERNEL */ 76*f9fbec18Smcpowers 77*f9fbec18Smcpowers #include "mpi.h" 78*f9fbec18Smcpowers #include "mplogic.h" 79*f9fbec18Smcpowers #include "mpprime.h" 80*f9fbec18Smcpowers #include "mp_gf2m.h" 81*f9fbec18Smcpowers #include "ecl.h" 82*f9fbec18Smcpowers #include "ecl-curve.h" 83*f9fbec18Smcpowers #include "ec2.h" 84*f9fbec18Smcpowers #include "ecc_impl.h" 85*f9fbec18Smcpowers #include "ec.h" 86*f9fbec18Smcpowers 87*f9fbec18Smcpowers #ifndef KM_SLEEP 88*f9fbec18Smcpowers #define KM_SLEEP 0 89*f9fbec18Smcpowers #endif 90*f9fbec18Smcpowers 91*f9fbec18Smcpowers #ifndef _KERNEL 92*f9fbec18Smcpowers /* Time k repetitions of operation op. */ 93*f9fbec18Smcpowers #define M_TimeOperation(op, k) { \ 94*f9fbec18Smcpowers double dStart, dNow, dUserTime; \ 95*f9fbec18Smcpowers struct rusage ru; \ 96*f9fbec18Smcpowers int i; \ 97*f9fbec18Smcpowers getrusage(RUSAGE_SELF, &ru); \ 98*f9fbec18Smcpowers dStart = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \ 99*f9fbec18Smcpowers for (i = 0; i < k; i++) { \ 100*f9fbec18Smcpowers { op; } \ 101*f9fbec18Smcpowers }; \ 102*f9fbec18Smcpowers getrusage(RUSAGE_SELF, &ru); \ 103*f9fbec18Smcpowers dNow = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \ 104*f9fbec18Smcpowers dUserTime = dNow-dStart; \ 105*f9fbec18Smcpowers if (dUserTime) printf(" %-45s k: %6i, t: %6.2f sec\n", #op, k, dUserTime); \ 106*f9fbec18Smcpowers } 107*f9fbec18Smcpowers #else 108*f9fbec18Smcpowers #define M_TimeOperation(op, k) 109*f9fbec18Smcpowers #endif 110*f9fbec18Smcpowers 111*f9fbec18Smcpowers /* Test curve using generic field arithmetic. */ 112*f9fbec18Smcpowers #define ECTEST_GENERIC_GF2M(name_c, name) \ 113*f9fbec18Smcpowers printf("Testing %s using generic implementation...\n", name_c); \ 114*f9fbec18Smcpowers params = EC_GetNamedCurveParams(name, KM_SLEEP); \ 115*f9fbec18Smcpowers if (params == NULL) { \ 116*f9fbec18Smcpowers printf(" Error: could not construct params.\n"); \ 117*f9fbec18Smcpowers res = MP_NO; \ 118*f9fbec18Smcpowers goto CLEANUP; \ 119*f9fbec18Smcpowers } \ 120*f9fbec18Smcpowers ECGroup_free(group); \ 121*f9fbec18Smcpowers group = ECGroup_fromHex(params, KM_SLEEP); \ 122*f9fbec18Smcpowers if (group == NULL) { \ 123*f9fbec18Smcpowers printf(" Error: could not construct group.\n"); \ 124*f9fbec18Smcpowers res = MP_NO; \ 125*f9fbec18Smcpowers goto CLEANUP; \ 126*f9fbec18Smcpowers } \ 127*f9fbec18Smcpowers MP_CHECKOK( ectest_curve_GF2m(group, ectestPrint, ectestTime, 1, KM_SLEEP) ); \ 128*f9fbec18Smcpowers printf("... okay.\n"); 129*f9fbec18Smcpowers 130*f9fbec18Smcpowers /* Test curve using specific field arithmetic. */ 131*f9fbec18Smcpowers #define ECTEST_NAMED_GF2M(name_c, name) \ 132*f9fbec18Smcpowers printf("Testing %s using specific implementation...\n", name_c); \ 133*f9fbec18Smcpowers ECGroup_free(group); \ 134*f9fbec18Smcpowers group = ECGroup_fromName(name, KM_SLEEP); \ 135*f9fbec18Smcpowers if (group == NULL) { \ 136*f9fbec18Smcpowers printf(" Warning: could not construct group.\n"); \ 137*f9fbec18Smcpowers printf("... failed; continuing with remaining tests.\n"); \ 138*f9fbec18Smcpowers } else { \ 139*f9fbec18Smcpowers MP_CHECKOK( ectest_curve_GF2m(group, ectestPrint, ectestTime, 0, KM_SLEEP) ); \ 140*f9fbec18Smcpowers printf("... okay.\n"); \ 141*f9fbec18Smcpowers } 142*f9fbec18Smcpowers 143*f9fbec18Smcpowers /* Performs basic tests of elliptic curve cryptography over binary 144*f9fbec18Smcpowers * polynomial fields. If tests fail, then it prints an error message, 145*f9fbec18Smcpowers * aborts, and returns an error code. Otherwise, returns 0. */ 146*f9fbec18Smcpowers int 147*f9fbec18Smcpowers ectest_curve_GF2m(ECGroup *group, int ectestPrint, int ectestTime, 148*f9fbec18Smcpowers int generic, int kmflag) 149*f9fbec18Smcpowers { 150*f9fbec18Smcpowers 151*f9fbec18Smcpowers mp_int one, order_1, gx, gy, rx, ry, n; 152*f9fbec18Smcpowers int size; 153*f9fbec18Smcpowers mp_err res; 154*f9fbec18Smcpowers char s[1000]; 155*f9fbec18Smcpowers 156*f9fbec18Smcpowers /* initialize values */ 157*f9fbec18Smcpowers MP_CHECKOK(mp_init(&one, kmflag)); 158*f9fbec18Smcpowers MP_CHECKOK(mp_init(&order_1, kmflag)); 159*f9fbec18Smcpowers MP_CHECKOK(mp_init(&gx, kmflag)); 160*f9fbec18Smcpowers MP_CHECKOK(mp_init(&gy, kmflag)); 161*f9fbec18Smcpowers MP_CHECKOK(mp_init(&rx, kmflag)); 162*f9fbec18Smcpowers MP_CHECKOK(mp_init(&ry, kmflag)); 163*f9fbec18Smcpowers MP_CHECKOK(mp_init(&n, kmflag)); 164*f9fbec18Smcpowers 165*f9fbec18Smcpowers MP_CHECKOK(mp_set_int(&one, 1)); 166*f9fbec18Smcpowers MP_CHECKOK(mp_sub(&group->order, &one, &order_1)); 167*f9fbec18Smcpowers 168*f9fbec18Smcpowers /* encode base point */ 169*f9fbec18Smcpowers if (group->meth->field_dec) { 170*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(&group->genx, &gx, group->meth)); 171*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(&group->geny, &gy, group->meth)); 172*f9fbec18Smcpowers } else { 173*f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->genx, &gx)); 174*f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->geny, &gy)); 175*f9fbec18Smcpowers } 176*f9fbec18Smcpowers 177*f9fbec18Smcpowers if (ectestPrint) { 178*f9fbec18Smcpowers /* output base point */ 179*f9fbec18Smcpowers printf(" base point P:\n"); 180*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&gx, s, 16)); 181*f9fbec18Smcpowers printf(" %s\n", s); 182*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&gy, s, 16)); 183*f9fbec18Smcpowers printf(" %s\n", s); 184*f9fbec18Smcpowers if (group->meth->field_enc) { 185*f9fbec18Smcpowers printf(" base point P (encoded):\n"); 186*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&group->genx, s, 16)); 187*f9fbec18Smcpowers printf(" %s\n", s); 188*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&group->geny, s, 16)); 189*f9fbec18Smcpowers printf(" %s\n", s); 190*f9fbec18Smcpowers } 191*f9fbec18Smcpowers } 192*f9fbec18Smcpowers 193*f9fbec18Smcpowers #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF 194*f9fbec18Smcpowers /* multiply base point by order - 1 and check for negative of base 195*f9fbec18Smcpowers * point */ 196*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_aff 197*f9fbec18Smcpowers (&order_1, &group->genx, &group->geny, &rx, &ry, group)); 198*f9fbec18Smcpowers if (ectestPrint) { 199*f9fbec18Smcpowers printf(" (order-1)*P (affine):\n"); 200*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 201*f9fbec18Smcpowers printf(" %s\n", s); 202*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 203*f9fbec18Smcpowers printf(" %s\n", s); 204*f9fbec18Smcpowers } 205*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_add(&ry, &rx, &ry, group->meth)); 206*f9fbec18Smcpowers if ((mp_cmp(&rx, &group->genx) != 0) 207*f9fbec18Smcpowers || (mp_cmp(&ry, &group->geny) != 0)) { 208*f9fbec18Smcpowers printf(" Error: invalid result (expected (- base point)).\n"); 209*f9fbec18Smcpowers res = MP_NO; 210*f9fbec18Smcpowers goto CLEANUP; 211*f9fbec18Smcpowers } 212*f9fbec18Smcpowers #endif 213*f9fbec18Smcpowers 214*f9fbec18Smcpowers /* multiply base point by order - 1 and check for negative of base 215*f9fbec18Smcpowers * point */ 216*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_mont 217*f9fbec18Smcpowers (&order_1, &group->genx, &group->geny, &rx, &ry, group)); 218*f9fbec18Smcpowers if (ectestPrint) { 219*f9fbec18Smcpowers printf(" (order-1)*P (montgomery):\n"); 220*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 221*f9fbec18Smcpowers printf(" %s\n", s); 222*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 223*f9fbec18Smcpowers printf(" %s\n", s); 224*f9fbec18Smcpowers } 225*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_add(&ry, &rx, &ry, group->meth)); 226*f9fbec18Smcpowers if ((mp_cmp(&rx, &group->genx) != 0) 227*f9fbec18Smcpowers || (mp_cmp(&ry, &group->geny) != 0)) { 228*f9fbec18Smcpowers printf(" Error: invalid result (expected (- base point)).\n"); 229*f9fbec18Smcpowers res = MP_NO; 230*f9fbec18Smcpowers goto CLEANUP; 231*f9fbec18Smcpowers } 232*f9fbec18Smcpowers 233*f9fbec18Smcpowers #ifdef ECL_ENABLE_GF2M_PROJ 234*f9fbec18Smcpowers /* multiply base point by order - 1 and check for negative of base 235*f9fbec18Smcpowers * point */ 236*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_proj 237*f9fbec18Smcpowers (&order_1, &group->genx, &group->geny, &rx, &ry, group)); 238*f9fbec18Smcpowers if (ectestPrint) { 239*f9fbec18Smcpowers printf(" (order-1)*P (projective):\n"); 240*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 241*f9fbec18Smcpowers printf(" %s\n", s); 242*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 243*f9fbec18Smcpowers printf(" %s\n", s); 244*f9fbec18Smcpowers } 245*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_add(&ry, &rx, &ry, group->meth)); 246*f9fbec18Smcpowers if ((mp_cmp(&rx, &group->genx) != 0) 247*f9fbec18Smcpowers || (mp_cmp(&ry, &group->geny) != 0)) { 248*f9fbec18Smcpowers printf(" Error: invalid result (expected (- base point)).\n"); 249*f9fbec18Smcpowers res = MP_NO; 250*f9fbec18Smcpowers goto CLEANUP; 251*f9fbec18Smcpowers } 252*f9fbec18Smcpowers #endif 253*f9fbec18Smcpowers 254*f9fbec18Smcpowers /* multiply base point by order - 1 and check for negative of base 255*f9fbec18Smcpowers * point */ 256*f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, &order_1, NULL, NULL, &rx, &ry)); 257*f9fbec18Smcpowers if (ectestPrint) { 258*f9fbec18Smcpowers printf(" (order-1)*P (ECPoint_mul):\n"); 259*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 260*f9fbec18Smcpowers printf(" %s\n", s); 261*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 262*f9fbec18Smcpowers printf(" %s\n", s); 263*f9fbec18Smcpowers } 264*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_add(&ry, &rx, &ry, group->meth)); 265*f9fbec18Smcpowers if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) { 266*f9fbec18Smcpowers printf(" Error: invalid result (expected (- base point)).\n"); 267*f9fbec18Smcpowers res = MP_NO; 268*f9fbec18Smcpowers goto CLEANUP; 269*f9fbec18Smcpowers } 270*f9fbec18Smcpowers 271*f9fbec18Smcpowers /* multiply base point by order - 1 and check for negative of base 272*f9fbec18Smcpowers * point */ 273*f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, &order_1, &gx, &gy, &rx, &ry)); 274*f9fbec18Smcpowers if (ectestPrint) { 275*f9fbec18Smcpowers printf(" (order-1)*P (ECPoint_mul):\n"); 276*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 277*f9fbec18Smcpowers printf(" %s\n", s); 278*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 279*f9fbec18Smcpowers printf(" %s\n", s); 280*f9fbec18Smcpowers } 281*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_add(&ry, &rx, &ry, group->meth)); 282*f9fbec18Smcpowers if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) { 283*f9fbec18Smcpowers printf(" Error: invalid result (expected (- base point)).\n"); 284*f9fbec18Smcpowers res = MP_NO; 285*f9fbec18Smcpowers goto CLEANUP; 286*f9fbec18Smcpowers } 287*f9fbec18Smcpowers 288*f9fbec18Smcpowers #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF 289*f9fbec18Smcpowers /* multiply base point by order and check for point at infinity */ 290*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_aff 291*f9fbec18Smcpowers (&group->order, &group->genx, &group->geny, &rx, &ry, 292*f9fbec18Smcpowers group)); 293*f9fbec18Smcpowers if (ectestPrint) { 294*f9fbec18Smcpowers printf(" (order)*P (affine):\n"); 295*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 296*f9fbec18Smcpowers printf(" %s\n", s); 297*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 298*f9fbec18Smcpowers printf(" %s\n", s); 299*f9fbec18Smcpowers } 300*f9fbec18Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) { 301*f9fbec18Smcpowers printf(" Error: invalid result (expected point at infinity).\n"); 302*f9fbec18Smcpowers res = MP_NO; 303*f9fbec18Smcpowers goto CLEANUP; 304*f9fbec18Smcpowers } 305*f9fbec18Smcpowers #endif 306*f9fbec18Smcpowers 307*f9fbec18Smcpowers /* multiply base point by order and check for point at infinity */ 308*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_mont 309*f9fbec18Smcpowers (&group->order, &group->genx, &group->geny, &rx, &ry, 310*f9fbec18Smcpowers group)); 311*f9fbec18Smcpowers if (ectestPrint) { 312*f9fbec18Smcpowers printf(" (order)*P (montgomery):\n"); 313*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 314*f9fbec18Smcpowers printf(" %s\n", s); 315*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 316*f9fbec18Smcpowers printf(" %s\n", s); 317*f9fbec18Smcpowers } 318*f9fbec18Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) { 319*f9fbec18Smcpowers printf(" Error: invalid result (expected point at infinity).\n"); 320*f9fbec18Smcpowers res = MP_NO; 321*f9fbec18Smcpowers goto CLEANUP; 322*f9fbec18Smcpowers } 323*f9fbec18Smcpowers 324*f9fbec18Smcpowers #ifdef ECL_ENABLE_GF2M_PROJ 325*f9fbec18Smcpowers /* multiply base point by order and check for point at infinity */ 326*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_proj 327*f9fbec18Smcpowers (&group->order, &group->genx, &group->geny, &rx, &ry, 328*f9fbec18Smcpowers group)); 329*f9fbec18Smcpowers if (ectestPrint) { 330*f9fbec18Smcpowers printf(" (order)*P (projective):\n"); 331*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 332*f9fbec18Smcpowers printf(" %s\n", s); 333*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 334*f9fbec18Smcpowers printf(" %s\n", s); 335*f9fbec18Smcpowers } 336*f9fbec18Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) { 337*f9fbec18Smcpowers printf(" Error: invalid result (expected point at infinity).\n"); 338*f9fbec18Smcpowers res = MP_NO; 339*f9fbec18Smcpowers goto CLEANUP; 340*f9fbec18Smcpowers } 341*f9fbec18Smcpowers #endif 342*f9fbec18Smcpowers 343*f9fbec18Smcpowers /* multiply base point by order and check for point at infinity */ 344*f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, &group->order, NULL, NULL, &rx, &ry)); 345*f9fbec18Smcpowers if (ectestPrint) { 346*f9fbec18Smcpowers printf(" (order)*P (ECPoint_mul):\n"); 347*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 348*f9fbec18Smcpowers printf(" %s\n", s); 349*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 350*f9fbec18Smcpowers printf(" %s\n", s); 351*f9fbec18Smcpowers } 352*f9fbec18Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) { 353*f9fbec18Smcpowers printf(" Error: invalid result (expected point at infinity).\n"); 354*f9fbec18Smcpowers res = MP_NO; 355*f9fbec18Smcpowers goto CLEANUP; 356*f9fbec18Smcpowers } 357*f9fbec18Smcpowers 358*f9fbec18Smcpowers /* multiply base point by order and check for point at infinity */ 359*f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, &group->order, &gx, &gy, &rx, &ry)); 360*f9fbec18Smcpowers if (ectestPrint) { 361*f9fbec18Smcpowers printf(" (order)*P (ECPoint_mul):\n"); 362*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 363*f9fbec18Smcpowers printf(" %s\n", s); 364*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 365*f9fbec18Smcpowers printf(" %s\n", s); 366*f9fbec18Smcpowers } 367*f9fbec18Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) { 368*f9fbec18Smcpowers printf(" Error: invalid result (expected point at infinity).\n"); 369*f9fbec18Smcpowers res = MP_NO; 370*f9fbec18Smcpowers goto CLEANUP; 371*f9fbec18Smcpowers } 372*f9fbec18Smcpowers 373*f9fbec18Smcpowers /* check that (order-1)P + (order-1)P + P == (order-1)P */ 374*f9fbec18Smcpowers MP_CHECKOK(ECPoints_mul 375*f9fbec18Smcpowers (group, &order_1, &order_1, &gx, &gy, &rx, &ry)); 376*f9fbec18Smcpowers MP_CHECKOK(ECPoints_mul(group, &one, &one, &rx, &ry, &rx, &ry)); 377*f9fbec18Smcpowers if (ectestPrint) { 378*f9fbec18Smcpowers printf 379*f9fbec18Smcpowers (" (order-1)*P + (order-1)*P + P == (order-1)*P (ECPoints_mul):\n"); 380*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16)); 381*f9fbec18Smcpowers printf(" %s\n", s); 382*f9fbec18Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16)); 383*f9fbec18Smcpowers printf(" %s\n", s); 384*f9fbec18Smcpowers } 385*f9fbec18Smcpowers MP_CHECKOK(ec_GF2m_add(&ry, &rx, &ry, group->meth)); 386*f9fbec18Smcpowers if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) { 387*f9fbec18Smcpowers printf(" Error: invalid result (expected (- base point)).\n"); 388*f9fbec18Smcpowers res = MP_NO; 389*f9fbec18Smcpowers goto CLEANUP; 390*f9fbec18Smcpowers } 391*f9fbec18Smcpowers 392*f9fbec18Smcpowers /* test validate_point function */ 393*f9fbec18Smcpowers if (ECPoint_validate(group, &gx, &gy) != MP_YES) { 394*f9fbec18Smcpowers printf(" Error: validate point on base point failed.\n"); 395*f9fbec18Smcpowers res = MP_NO; 396*f9fbec18Smcpowers goto CLEANUP; 397*f9fbec18Smcpowers } 398*f9fbec18Smcpowers MP_CHECKOK(mp_add_d(&gy, 1, &ry)); 399*f9fbec18Smcpowers if (ECPoint_validate(group, &gx, &ry) != MP_NO) { 400*f9fbec18Smcpowers printf(" Error: validate point on invalid point passed.\n"); 401*f9fbec18Smcpowers res = MP_NO; 402*f9fbec18Smcpowers goto CLEANUP; 403*f9fbec18Smcpowers } 404*f9fbec18Smcpowers 405*f9fbec18Smcpowers if (ectestTime) { 406*f9fbec18Smcpowers /* compute random scalar */ 407*f9fbec18Smcpowers size = mpl_significant_bits(&group->meth->irr); 408*f9fbec18Smcpowers if (size < MP_OKAY) { 409*f9fbec18Smcpowers goto CLEANUP; 410*f9fbec18Smcpowers } 411*f9fbec18Smcpowers MP_CHECKOK(mpp_random_size(&n, (size + ECL_BITS - 1) / ECL_BITS)); 412*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_mod(&n, &n, group->meth)); 413*f9fbec18Smcpowers /* timed test */ 414*f9fbec18Smcpowers if (generic) { 415*f9fbec18Smcpowers #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF 416*f9fbec18Smcpowers M_TimeOperation(MP_CHECKOK 417*f9fbec18Smcpowers (ec_GF2m_pt_mul_aff 418*f9fbec18Smcpowers (&n, &group->genx, &group->geny, &rx, &ry, 419*f9fbec18Smcpowers group)), 100); 420*f9fbec18Smcpowers #endif 421*f9fbec18Smcpowers M_TimeOperation(MP_CHECKOK 422*f9fbec18Smcpowers (ECPoint_mul(group, &n, NULL, NULL, &rx, &ry)), 423*f9fbec18Smcpowers 100); 424*f9fbec18Smcpowers M_TimeOperation(MP_CHECKOK 425*f9fbec18Smcpowers (ECPoints_mul 426*f9fbec18Smcpowers (group, &n, &n, &gx, &gy, &rx, &ry)), 100); 427*f9fbec18Smcpowers } else { 428*f9fbec18Smcpowers M_TimeOperation(MP_CHECKOK 429*f9fbec18Smcpowers (ECPoint_mul(group, &n, NULL, NULL, &rx, &ry)), 430*f9fbec18Smcpowers 100); 431*f9fbec18Smcpowers M_TimeOperation(MP_CHECKOK 432*f9fbec18Smcpowers (ECPoint_mul(group, &n, &gx, &gy, &rx, &ry)), 433*f9fbec18Smcpowers 100); 434*f9fbec18Smcpowers M_TimeOperation(MP_CHECKOK 435*f9fbec18Smcpowers (ECPoints_mul 436*f9fbec18Smcpowers (group, &n, &n, &gx, &gy, &rx, &ry)), 100); 437*f9fbec18Smcpowers } 438*f9fbec18Smcpowers } 439*f9fbec18Smcpowers 440*f9fbec18Smcpowers CLEANUP: 441*f9fbec18Smcpowers mp_clear(&one); 442*f9fbec18Smcpowers mp_clear(&order_1); 443*f9fbec18Smcpowers mp_clear(&gx); 444*f9fbec18Smcpowers mp_clear(&gy); 445*f9fbec18Smcpowers mp_clear(&rx); 446*f9fbec18Smcpowers mp_clear(&ry); 447*f9fbec18Smcpowers mp_clear(&n); 448*f9fbec18Smcpowers if (res != MP_OKAY) { 449*f9fbec18Smcpowers #ifdef _KERNEL 450*f9fbec18Smcpowers printf(" Error: exiting with error value 0x%x\n", res); 451*f9fbec18Smcpowers #else 452*f9fbec18Smcpowers printf(" Error: exiting with error value %i\n", res); 453*f9fbec18Smcpowers #endif 454*f9fbec18Smcpowers } 455*f9fbec18Smcpowers return res; 456*f9fbec18Smcpowers } 457*f9fbec18Smcpowers 458*f9fbec18Smcpowers /* Performs tests of elliptic curve cryptography over binary polynomial 459*f9fbec18Smcpowers * fields. If tests fail, then it prints an error message, aborts, and 460*f9fbec18Smcpowers * returns an error code. Otherwise, returns 0. */ 461*f9fbec18Smcpowers int 462*f9fbec18Smcpowers ec2_test() 463*f9fbec18Smcpowers { 464*f9fbec18Smcpowers int ectestTime = 0; 465*f9fbec18Smcpowers int ectestPrint = 0; 466*f9fbec18Smcpowers int i; 467*f9fbec18Smcpowers ECGroup *group = NULL; 468*f9fbec18Smcpowers ECCurveParams *params = NULL; 469*f9fbec18Smcpowers mp_err res; 470*f9fbec18Smcpowers 471*f9fbec18Smcpowers /* generic arithmetic tests */ 472*f9fbec18Smcpowers ECTEST_GENERIC_GF2M("SECT-131R1", ECCurve_SECG_CHAR2_131R1); 473*f9fbec18Smcpowers 474*f9fbec18Smcpowers /* specific arithmetic tests */ 475*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-K163", ECCurve_NIST_K163); 476*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-B163", ECCurve_NIST_B163); 477*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-K233", ECCurve_NIST_K233); 478*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-B233", ECCurve_NIST_B233); 479*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-K283", ECCurve_NIST_K283); 480*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-B283", ECCurve_NIST_B283); 481*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-K409", ECCurve_NIST_K409); 482*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-B409", ECCurve_NIST_B409); 483*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-K571", ECCurve_NIST_K571); 484*f9fbec18Smcpowers ECTEST_NAMED_GF2M("NIST-B571", ECCurve_NIST_B571); 485*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V1", ECCurve_X9_62_CHAR2_PNB163V1); 486*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V2", ECCurve_X9_62_CHAR2_PNB163V2); 487*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V3", ECCurve_X9_62_CHAR2_PNB163V3); 488*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB176V1", ECCurve_X9_62_CHAR2_PNB176V1); 489*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V1", ECCurve_X9_62_CHAR2_TNB191V1); 490*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V2", ECCurve_X9_62_CHAR2_TNB191V2); 491*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V3", ECCurve_X9_62_CHAR2_TNB191V3); 492*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB208W1", ECCurve_X9_62_CHAR2_PNB208W1); 493*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V1", ECCurve_X9_62_CHAR2_TNB239V1); 494*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V2", ECCurve_X9_62_CHAR2_TNB239V2); 495*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V3", ECCurve_X9_62_CHAR2_TNB239V3); 496*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB272W1", ECCurve_X9_62_CHAR2_PNB272W1); 497*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB304W1", ECCurve_X9_62_CHAR2_PNB304W1); 498*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB359V1", ECCurve_X9_62_CHAR2_TNB359V1); 499*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB368W1", ECCurve_X9_62_CHAR2_PNB368W1); 500*f9fbec18Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB431R1", ECCurve_X9_62_CHAR2_TNB431R1); 501*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-113R1", ECCurve_SECG_CHAR2_113R1); 502*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-113R2", ECCurve_SECG_CHAR2_113R2); 503*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-131R1", ECCurve_SECG_CHAR2_131R1); 504*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-131R2", ECCurve_SECG_CHAR2_131R2); 505*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-163K1", ECCurve_SECG_CHAR2_163K1); 506*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-163R1", ECCurve_SECG_CHAR2_163R1); 507*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-163R2", ECCurve_SECG_CHAR2_163R2); 508*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-193R1", ECCurve_SECG_CHAR2_193R1); 509*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-193R2", ECCurve_SECG_CHAR2_193R2); 510*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-233K1", ECCurve_SECG_CHAR2_233K1); 511*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-233R1", ECCurve_SECG_CHAR2_233R1); 512*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-239K1", ECCurve_SECG_CHAR2_239K1); 513*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-283K1", ECCurve_SECG_CHAR2_283K1); 514*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-283R1", ECCurve_SECG_CHAR2_283R1); 515*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-409K1", ECCurve_SECG_CHAR2_409K1); 516*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-409R1", ECCurve_SECG_CHAR2_409R1); 517*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-571K1", ECCurve_SECG_CHAR2_571K1); 518*f9fbec18Smcpowers ECTEST_NAMED_GF2M("SECT-571R1", ECCurve_SECG_CHAR2_571R1); 519*f9fbec18Smcpowers ECTEST_NAMED_GF2M("WTLS-1 (113)", ECCurve_WTLS_1); 520*f9fbec18Smcpowers ECTEST_NAMED_GF2M("WTLS-3 (163)", ECCurve_WTLS_3); 521*f9fbec18Smcpowers ECTEST_NAMED_GF2M("WTLS-4 (113)", ECCurve_WTLS_4); 522*f9fbec18Smcpowers ECTEST_NAMED_GF2M("WTLS-5 (163)", ECCurve_WTLS_5); 523*f9fbec18Smcpowers ECTEST_NAMED_GF2M("WTLS-10 (233)", ECCurve_WTLS_10); 524*f9fbec18Smcpowers ECTEST_NAMED_GF2M("WTLS-11 (233)", ECCurve_WTLS_11); 525*f9fbec18Smcpowers 526*f9fbec18Smcpowers CLEANUP: 527*f9fbec18Smcpowers EC_FreeCurveParams(params); 528*f9fbec18Smcpowers ECGroup_free(group); 529*f9fbec18Smcpowers if (res != MP_OKAY) { 530*f9fbec18Smcpowers #ifdef _KERNEL 531*f9fbec18Smcpowers printf("Error: exiting with error value 0x%x\n", res); 532*f9fbec18Smcpowers #else 533*f9fbec18Smcpowers printf("Error: exiting with error value %i\n", res); 534*f9fbec18Smcpowers #endif 535*f9fbec18Smcpowers } 536*f9fbec18Smcpowers return res; 537*f9fbec18Smcpowers } 538