1*f9fbec18Smcpowers /*
2*f9fbec18Smcpowers * ***** BEGIN LICENSE BLOCK *****
3*f9fbec18Smcpowers * Version: MPL 1.1/GPL 2.0/LGPL 2.1
4*f9fbec18Smcpowers *
5*f9fbec18Smcpowers * The contents of this file are subject to the Mozilla Public License Version
6*f9fbec18Smcpowers * 1.1 (the "License"); you may not use this file except in compliance with
7*f9fbec18Smcpowers * the License. You may obtain a copy of the License at
8*f9fbec18Smcpowers * http://www.mozilla.org/MPL/
9*f9fbec18Smcpowers *
10*f9fbec18Smcpowers * Software distributed under the License is distributed on an "AS IS" basis,
11*f9fbec18Smcpowers * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
12*f9fbec18Smcpowers * for the specific language governing rights and limitations under the
13*f9fbec18Smcpowers * License.
14*f9fbec18Smcpowers *
15*f9fbec18Smcpowers * The Original Code is the elliptic curve math library.
16*f9fbec18Smcpowers *
17*f9fbec18Smcpowers * The Initial Developer of the Original Code is
18*f9fbec18Smcpowers * Sun Microsystems, Inc.
19*f9fbec18Smcpowers * Portions created by the Initial Developer are Copyright (C) 2003
20*f9fbec18Smcpowers * the Initial Developer. All Rights Reserved.
21*f9fbec18Smcpowers *
22*f9fbec18Smcpowers * Contributor(s):
23*f9fbec18Smcpowers * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories
24*f9fbec18Smcpowers *
25*f9fbec18Smcpowers * Alternatively, the contents of this file may be used under the terms of
26*f9fbec18Smcpowers * either the GNU General Public License Version 2 or later (the "GPL"), or
27*f9fbec18Smcpowers * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
28*f9fbec18Smcpowers * in which case the provisions of the GPL or the LGPL are applicable instead
29*f9fbec18Smcpowers * of those above. If you wish to allow use of your version of this file only
30*f9fbec18Smcpowers * under the terms of either the GPL or the LGPL, and not to allow others to
31*f9fbec18Smcpowers * use your version of this file under the terms of the MPL, indicate your
32*f9fbec18Smcpowers * decision by deleting the provisions above and replace them with the notice
33*f9fbec18Smcpowers * and other provisions required by the GPL or the LGPL. If you do not delete
34*f9fbec18Smcpowers * the provisions above, a recipient may use your version of this file under
35*f9fbec18Smcpowers * the terms of any one of the MPL, the GPL or the LGPL.
36*f9fbec18Smcpowers *
37*f9fbec18Smcpowers * ***** END LICENSE BLOCK ***** */
38*f9fbec18Smcpowers /*
39*f9fbec18Smcpowers * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
40*f9fbec18Smcpowers * Use is subject to license terms.
41*f9fbec18Smcpowers *
42*f9fbec18Smcpowers * Sun elects to use this software under the MPL license.
43*f9fbec18Smcpowers */
44*f9fbec18Smcpowers
45*f9fbec18Smcpowers #include "mpi.h"
46*f9fbec18Smcpowers #include "mplogic.h"
47*f9fbec18Smcpowers #include "ecl.h"
48*f9fbec18Smcpowers #include "ecl-priv.h"
49*f9fbec18Smcpowers #ifndef _KERNEL
50*f9fbec18Smcpowers #include <stdlib.h>
51*f9fbec18Smcpowers #endif
52*f9fbec18Smcpowers
53*f9fbec18Smcpowers /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k * P(x,
54*f9fbec18Smcpowers * y). If x, y = NULL, then P is assumed to be the generator (base point)
55*f9fbec18Smcpowers * of the group of points on the elliptic curve. Input and output values
56*f9fbec18Smcpowers * are assumed to be NOT field-encoded. */
57*f9fbec18Smcpowers mp_err
ECPoint_mul(const ECGroup * group,const mp_int * k,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry)58*f9fbec18Smcpowers ECPoint_mul(const ECGroup *group, const mp_int *k, const mp_int *px,
59*f9fbec18Smcpowers const mp_int *py, mp_int *rx, mp_int *ry)
60*f9fbec18Smcpowers {
61*f9fbec18Smcpowers mp_err res = MP_OKAY;
62*f9fbec18Smcpowers mp_int kt;
63*f9fbec18Smcpowers
64*f9fbec18Smcpowers ARGCHK((k != NULL) && (group != NULL), MP_BADARG);
65*f9fbec18Smcpowers MP_DIGITS(&kt) = 0;
66*f9fbec18Smcpowers
67*f9fbec18Smcpowers /* want scalar to be less than or equal to group order */
68*f9fbec18Smcpowers if (mp_cmp(k, &group->order) > 0) {
69*f9fbec18Smcpowers MP_CHECKOK(mp_init(&kt, FLAG(k)));
70*f9fbec18Smcpowers MP_CHECKOK(mp_mod(k, &group->order, &kt));
71*f9fbec18Smcpowers } else {
72*f9fbec18Smcpowers MP_SIGN(&kt) = MP_ZPOS;
73*f9fbec18Smcpowers MP_USED(&kt) = MP_USED(k);
74*f9fbec18Smcpowers MP_ALLOC(&kt) = MP_ALLOC(k);
75*f9fbec18Smcpowers MP_DIGITS(&kt) = MP_DIGITS(k);
76*f9fbec18Smcpowers }
77*f9fbec18Smcpowers
78*f9fbec18Smcpowers if ((px == NULL) || (py == NULL)) {
79*f9fbec18Smcpowers if (group->base_point_mul) {
80*f9fbec18Smcpowers MP_CHECKOK(group->base_point_mul(&kt, rx, ry, group));
81*f9fbec18Smcpowers } else {
82*f9fbec18Smcpowers MP_CHECKOK(group->
83*f9fbec18Smcpowers point_mul(&kt, &group->genx, &group->geny, rx, ry,
84*f9fbec18Smcpowers group));
85*f9fbec18Smcpowers }
86*f9fbec18Smcpowers } else {
87*f9fbec18Smcpowers if (group->meth->field_enc) {
88*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(px, rx, group->meth));
89*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(py, ry, group->meth));
90*f9fbec18Smcpowers MP_CHECKOK(group->point_mul(&kt, rx, ry, rx, ry, group));
91*f9fbec18Smcpowers } else {
92*f9fbec18Smcpowers MP_CHECKOK(group->point_mul(&kt, px, py, rx, ry, group));
93*f9fbec18Smcpowers }
94*f9fbec18Smcpowers }
95*f9fbec18Smcpowers if (group->meth->field_dec) {
96*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth));
97*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth));
98*f9fbec18Smcpowers }
99*f9fbec18Smcpowers
100*f9fbec18Smcpowers CLEANUP:
101*f9fbec18Smcpowers if (MP_DIGITS(&kt) != MP_DIGITS(k)) {
102*f9fbec18Smcpowers mp_clear(&kt);
103*f9fbec18Smcpowers }
104*f9fbec18Smcpowers return res;
105*f9fbec18Smcpowers }
106*f9fbec18Smcpowers
107*f9fbec18Smcpowers /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G +
108*f9fbec18Smcpowers * k2 * P(x, y), where G is the generator (base point) of the group of
109*f9fbec18Smcpowers * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL.
110*f9fbec18Smcpowers * Input and output values are assumed to be NOT field-encoded. */
111*f9fbec18Smcpowers mp_err
ec_pts_mul_basic(const mp_int * k1,const mp_int * k2,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry,const ECGroup * group)112*f9fbec18Smcpowers ec_pts_mul_basic(const mp_int *k1, const mp_int *k2, const mp_int *px,
113*f9fbec18Smcpowers const mp_int *py, mp_int *rx, mp_int *ry,
114*f9fbec18Smcpowers const ECGroup *group)
115*f9fbec18Smcpowers {
116*f9fbec18Smcpowers mp_err res = MP_OKAY;
117*f9fbec18Smcpowers mp_int sx, sy;
118*f9fbec18Smcpowers
119*f9fbec18Smcpowers ARGCHK(group != NULL, MP_BADARG);
120*f9fbec18Smcpowers ARGCHK(!((k1 == NULL)
121*f9fbec18Smcpowers && ((k2 == NULL) || (px == NULL)
122*f9fbec18Smcpowers || (py == NULL))), MP_BADARG);
123*f9fbec18Smcpowers
124*f9fbec18Smcpowers /* if some arguments are not defined used ECPoint_mul */
125*f9fbec18Smcpowers if (k1 == NULL) {
126*f9fbec18Smcpowers return ECPoint_mul(group, k2, px, py, rx, ry);
127*f9fbec18Smcpowers } else if ((k2 == NULL) || (px == NULL) || (py == NULL)) {
128*f9fbec18Smcpowers return ECPoint_mul(group, k1, NULL, NULL, rx, ry);
129*f9fbec18Smcpowers }
130*f9fbec18Smcpowers
131*f9fbec18Smcpowers MP_DIGITS(&sx) = 0;
132*f9fbec18Smcpowers MP_DIGITS(&sy) = 0;
133*f9fbec18Smcpowers MP_CHECKOK(mp_init(&sx, FLAG(k1)));
134*f9fbec18Smcpowers MP_CHECKOK(mp_init(&sy, FLAG(k1)));
135*f9fbec18Smcpowers
136*f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, k1, NULL, NULL, &sx, &sy));
137*f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, k2, px, py, rx, ry));
138*f9fbec18Smcpowers
139*f9fbec18Smcpowers if (group->meth->field_enc) {
140*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(&sx, &sx, group->meth));
141*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(&sy, &sy, group->meth));
142*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(rx, rx, group->meth));
143*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(ry, ry, group->meth));
144*f9fbec18Smcpowers }
145*f9fbec18Smcpowers
146*f9fbec18Smcpowers MP_CHECKOK(group->point_add(&sx, &sy, rx, ry, rx, ry, group));
147*f9fbec18Smcpowers
148*f9fbec18Smcpowers if (group->meth->field_dec) {
149*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth));
150*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth));
151*f9fbec18Smcpowers }
152*f9fbec18Smcpowers
153*f9fbec18Smcpowers CLEANUP:
154*f9fbec18Smcpowers mp_clear(&sx);
155*f9fbec18Smcpowers mp_clear(&sy);
156*f9fbec18Smcpowers return res;
157*f9fbec18Smcpowers }
158*f9fbec18Smcpowers
159*f9fbec18Smcpowers /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G +
160*f9fbec18Smcpowers * k2 * P(x, y), where G is the generator (base point) of the group of
161*f9fbec18Smcpowers * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL.
162*f9fbec18Smcpowers * Input and output values are assumed to be NOT field-encoded. Uses
163*f9fbec18Smcpowers * algorithm 15 (simultaneous multiple point multiplication) from Brown,
164*f9fbec18Smcpowers * Hankerson, Lopez, Menezes. Software Implementation of the NIST
165*f9fbec18Smcpowers * Elliptic Curves over Prime Fields. */
166*f9fbec18Smcpowers mp_err
ec_pts_mul_simul_w2(const mp_int * k1,const mp_int * k2,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry,const ECGroup * group)167*f9fbec18Smcpowers ec_pts_mul_simul_w2(const mp_int *k1, const mp_int *k2, const mp_int *px,
168*f9fbec18Smcpowers const mp_int *py, mp_int *rx, mp_int *ry,
169*f9fbec18Smcpowers const ECGroup *group)
170*f9fbec18Smcpowers {
171*f9fbec18Smcpowers mp_err res = MP_OKAY;
172*f9fbec18Smcpowers mp_int precomp[4][4][2];
173*f9fbec18Smcpowers const mp_int *a, *b;
174*f9fbec18Smcpowers int i, j;
175*f9fbec18Smcpowers int ai, bi, d;
176*f9fbec18Smcpowers
177*f9fbec18Smcpowers ARGCHK(group != NULL, MP_BADARG);
178*f9fbec18Smcpowers ARGCHK(!((k1 == NULL)
179*f9fbec18Smcpowers && ((k2 == NULL) || (px == NULL)
180*f9fbec18Smcpowers || (py == NULL))), MP_BADARG);
181*f9fbec18Smcpowers
182*f9fbec18Smcpowers /* if some arguments are not defined used ECPoint_mul */
183*f9fbec18Smcpowers if (k1 == NULL) {
184*f9fbec18Smcpowers return ECPoint_mul(group, k2, px, py, rx, ry);
185*f9fbec18Smcpowers } else if ((k2 == NULL) || (px == NULL) || (py == NULL)) {
186*f9fbec18Smcpowers return ECPoint_mul(group, k1, NULL, NULL, rx, ry);
187*f9fbec18Smcpowers }
188*f9fbec18Smcpowers
189*f9fbec18Smcpowers /* initialize precomputation table */
190*f9fbec18Smcpowers for (i = 0; i < 4; i++) {
191*f9fbec18Smcpowers for (j = 0; j < 4; j++) {
192*f9fbec18Smcpowers MP_DIGITS(&precomp[i][j][0]) = 0;
193*f9fbec18Smcpowers MP_DIGITS(&precomp[i][j][1]) = 0;
194*f9fbec18Smcpowers }
195*f9fbec18Smcpowers }
196*f9fbec18Smcpowers for (i = 0; i < 4; i++) {
197*f9fbec18Smcpowers for (j = 0; j < 4; j++) {
198*f9fbec18Smcpowers MP_CHECKOK( mp_init_size(&precomp[i][j][0],
199*f9fbec18Smcpowers ECL_MAX_FIELD_SIZE_DIGITS, FLAG(k1)) );
200*f9fbec18Smcpowers MP_CHECKOK( mp_init_size(&precomp[i][j][1],
201*f9fbec18Smcpowers ECL_MAX_FIELD_SIZE_DIGITS, FLAG(k1)) );
202*f9fbec18Smcpowers }
203*f9fbec18Smcpowers }
204*f9fbec18Smcpowers
205*f9fbec18Smcpowers /* fill precomputation table */
206*f9fbec18Smcpowers /* assign {k1, k2} = {a, b} such that len(a) >= len(b) */
207*f9fbec18Smcpowers if (mpl_significant_bits(k1) < mpl_significant_bits(k2)) {
208*f9fbec18Smcpowers a = k2;
209*f9fbec18Smcpowers b = k1;
210*f9fbec18Smcpowers if (group->meth->field_enc) {
211*f9fbec18Smcpowers MP_CHECKOK(group->meth->
212*f9fbec18Smcpowers field_enc(px, &precomp[1][0][0], group->meth));
213*f9fbec18Smcpowers MP_CHECKOK(group->meth->
214*f9fbec18Smcpowers field_enc(py, &precomp[1][0][1], group->meth));
215*f9fbec18Smcpowers } else {
216*f9fbec18Smcpowers MP_CHECKOK(mp_copy(px, &precomp[1][0][0]));
217*f9fbec18Smcpowers MP_CHECKOK(mp_copy(py, &precomp[1][0][1]));
218*f9fbec18Smcpowers }
219*f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->genx, &precomp[0][1][0]));
220*f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->geny, &precomp[0][1][1]));
221*f9fbec18Smcpowers } else {
222*f9fbec18Smcpowers a = k1;
223*f9fbec18Smcpowers b = k2;
224*f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->genx, &precomp[1][0][0]));
225*f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->geny, &precomp[1][0][1]));
226*f9fbec18Smcpowers if (group->meth->field_enc) {
227*f9fbec18Smcpowers MP_CHECKOK(group->meth->
228*f9fbec18Smcpowers field_enc(px, &precomp[0][1][0], group->meth));
229*f9fbec18Smcpowers MP_CHECKOK(group->meth->
230*f9fbec18Smcpowers field_enc(py, &precomp[0][1][1], group->meth));
231*f9fbec18Smcpowers } else {
232*f9fbec18Smcpowers MP_CHECKOK(mp_copy(px, &precomp[0][1][0]));
233*f9fbec18Smcpowers MP_CHECKOK(mp_copy(py, &precomp[0][1][1]));
234*f9fbec18Smcpowers }
235*f9fbec18Smcpowers }
236*f9fbec18Smcpowers /* precompute [*][0][*] */
237*f9fbec18Smcpowers mp_zero(&precomp[0][0][0]);
238*f9fbec18Smcpowers mp_zero(&precomp[0][0][1]);
239*f9fbec18Smcpowers MP_CHECKOK(group->
240*f9fbec18Smcpowers point_dbl(&precomp[1][0][0], &precomp[1][0][1],
241*f9fbec18Smcpowers &precomp[2][0][0], &precomp[2][0][1], group));
242*f9fbec18Smcpowers MP_CHECKOK(group->
243*f9fbec18Smcpowers point_add(&precomp[1][0][0], &precomp[1][0][1],
244*f9fbec18Smcpowers &precomp[2][0][0], &precomp[2][0][1],
245*f9fbec18Smcpowers &precomp[3][0][0], &precomp[3][0][1], group));
246*f9fbec18Smcpowers /* precompute [*][1][*] */
247*f9fbec18Smcpowers for (i = 1; i < 4; i++) {
248*f9fbec18Smcpowers MP_CHECKOK(group->
249*f9fbec18Smcpowers point_add(&precomp[0][1][0], &precomp[0][1][1],
250*f9fbec18Smcpowers &precomp[i][0][0], &precomp[i][0][1],
251*f9fbec18Smcpowers &precomp[i][1][0], &precomp[i][1][1], group));
252*f9fbec18Smcpowers }
253*f9fbec18Smcpowers /* precompute [*][2][*] */
254*f9fbec18Smcpowers MP_CHECKOK(group->
255*f9fbec18Smcpowers point_dbl(&precomp[0][1][0], &precomp[0][1][1],
256*f9fbec18Smcpowers &precomp[0][2][0], &precomp[0][2][1], group));
257*f9fbec18Smcpowers for (i = 1; i < 4; i++) {
258*f9fbec18Smcpowers MP_CHECKOK(group->
259*f9fbec18Smcpowers point_add(&precomp[0][2][0], &precomp[0][2][1],
260*f9fbec18Smcpowers &precomp[i][0][0], &precomp[i][0][1],
261*f9fbec18Smcpowers &precomp[i][2][0], &precomp[i][2][1], group));
262*f9fbec18Smcpowers }
263*f9fbec18Smcpowers /* precompute [*][3][*] */
264*f9fbec18Smcpowers MP_CHECKOK(group->
265*f9fbec18Smcpowers point_add(&precomp[0][1][0], &precomp[0][1][1],
266*f9fbec18Smcpowers &precomp[0][2][0], &precomp[0][2][1],
267*f9fbec18Smcpowers &precomp[0][3][0], &precomp[0][3][1], group));
268*f9fbec18Smcpowers for (i = 1; i < 4; i++) {
269*f9fbec18Smcpowers MP_CHECKOK(group->
270*f9fbec18Smcpowers point_add(&precomp[0][3][0], &precomp[0][3][1],
271*f9fbec18Smcpowers &precomp[i][0][0], &precomp[i][0][1],
272*f9fbec18Smcpowers &precomp[i][3][0], &precomp[i][3][1], group));
273*f9fbec18Smcpowers }
274*f9fbec18Smcpowers
275*f9fbec18Smcpowers d = (mpl_significant_bits(a) + 1) / 2;
276*f9fbec18Smcpowers
277*f9fbec18Smcpowers /* R = inf */
278*f9fbec18Smcpowers mp_zero(rx);
279*f9fbec18Smcpowers mp_zero(ry);
280*f9fbec18Smcpowers
281*f9fbec18Smcpowers for (i = d - 1; i >= 0; i--) {
282*f9fbec18Smcpowers ai = MP_GET_BIT(a, 2 * i + 1);
283*f9fbec18Smcpowers ai <<= 1;
284*f9fbec18Smcpowers ai |= MP_GET_BIT(a, 2 * i);
285*f9fbec18Smcpowers bi = MP_GET_BIT(b, 2 * i + 1);
286*f9fbec18Smcpowers bi <<= 1;
287*f9fbec18Smcpowers bi |= MP_GET_BIT(b, 2 * i);
288*f9fbec18Smcpowers /* R = 2^2 * R */
289*f9fbec18Smcpowers MP_CHECKOK(group->point_dbl(rx, ry, rx, ry, group));
290*f9fbec18Smcpowers MP_CHECKOK(group->point_dbl(rx, ry, rx, ry, group));
291*f9fbec18Smcpowers /* R = R + (ai * A + bi * B) */
292*f9fbec18Smcpowers MP_CHECKOK(group->
293*f9fbec18Smcpowers point_add(rx, ry, &precomp[ai][bi][0],
294*f9fbec18Smcpowers &precomp[ai][bi][1], rx, ry, group));
295*f9fbec18Smcpowers }
296*f9fbec18Smcpowers
297*f9fbec18Smcpowers if (group->meth->field_dec) {
298*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth));
299*f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth));
300*f9fbec18Smcpowers }
301*f9fbec18Smcpowers
302*f9fbec18Smcpowers CLEANUP:
303*f9fbec18Smcpowers for (i = 0; i < 4; i++) {
304*f9fbec18Smcpowers for (j = 0; j < 4; j++) {
305*f9fbec18Smcpowers mp_clear(&precomp[i][j][0]);
306*f9fbec18Smcpowers mp_clear(&precomp[i][j][1]);
307*f9fbec18Smcpowers }
308*f9fbec18Smcpowers }
309*f9fbec18Smcpowers return res;
310*f9fbec18Smcpowers }
311*f9fbec18Smcpowers
312*f9fbec18Smcpowers /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G +
313*f9fbec18Smcpowers * k2 * P(x, y), where G is the generator (base point) of the group of
314*f9fbec18Smcpowers * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL.
315*f9fbec18Smcpowers * Input and output values are assumed to be NOT field-encoded. */
316*f9fbec18Smcpowers mp_err
ECPoints_mul(const ECGroup * group,const mp_int * k1,const mp_int * k2,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry)317*f9fbec18Smcpowers ECPoints_mul(const ECGroup *group, const mp_int *k1, const mp_int *k2,
318*f9fbec18Smcpowers const mp_int *px, const mp_int *py, mp_int *rx, mp_int *ry)
319*f9fbec18Smcpowers {
320*f9fbec18Smcpowers mp_err res = MP_OKAY;
321*f9fbec18Smcpowers mp_int k1t, k2t;
322*f9fbec18Smcpowers const mp_int *k1p, *k2p;
323*f9fbec18Smcpowers
324*f9fbec18Smcpowers MP_DIGITS(&k1t) = 0;
325*f9fbec18Smcpowers MP_DIGITS(&k2t) = 0;
326*f9fbec18Smcpowers
327*f9fbec18Smcpowers ARGCHK(group != NULL, MP_BADARG);
328*f9fbec18Smcpowers
329*f9fbec18Smcpowers /* want scalar to be less than or equal to group order */
330*f9fbec18Smcpowers if (k1 != NULL) {
331*f9fbec18Smcpowers if (mp_cmp(k1, &group->order) >= 0) {
332*f9fbec18Smcpowers MP_CHECKOK(mp_init(&k1t, FLAG(k1)));
333*f9fbec18Smcpowers MP_CHECKOK(mp_mod(k1, &group->order, &k1t));
334*f9fbec18Smcpowers k1p = &k1t;
335*f9fbec18Smcpowers } else {
336*f9fbec18Smcpowers k1p = k1;
337*f9fbec18Smcpowers }
338*f9fbec18Smcpowers } else {
339*f9fbec18Smcpowers k1p = k1;
340*f9fbec18Smcpowers }
341*f9fbec18Smcpowers if (k2 != NULL) {
342*f9fbec18Smcpowers if (mp_cmp(k2, &group->order) >= 0) {
343*f9fbec18Smcpowers MP_CHECKOK(mp_init(&k2t, FLAG(k2)));
344*f9fbec18Smcpowers MP_CHECKOK(mp_mod(k2, &group->order, &k2t));
345*f9fbec18Smcpowers k2p = &k2t;
346*f9fbec18Smcpowers } else {
347*f9fbec18Smcpowers k2p = k2;
348*f9fbec18Smcpowers }
349*f9fbec18Smcpowers } else {
350*f9fbec18Smcpowers k2p = k2;
351*f9fbec18Smcpowers }
352*f9fbec18Smcpowers
353*f9fbec18Smcpowers /* if points_mul is defined, then use it */
354*f9fbec18Smcpowers if (group->points_mul) {
355*f9fbec18Smcpowers res = group->points_mul(k1p, k2p, px, py, rx, ry, group);
356*f9fbec18Smcpowers } else {
357*f9fbec18Smcpowers res = ec_pts_mul_simul_w2(k1p, k2p, px, py, rx, ry, group);
358*f9fbec18Smcpowers }
359*f9fbec18Smcpowers
360*f9fbec18Smcpowers CLEANUP:
361*f9fbec18Smcpowers mp_clear(&k1t);
362*f9fbec18Smcpowers mp_clear(&k2t);
363*f9fbec18Smcpowers return res;
364*f9fbec18Smcpowers }
365