13209474962

Committed 07 Feb 2025 11:03PM UTC coverage: 91.278% (-0.001%) from 91.279%

Build # 13209474962

Build Type

Pull #4648

github

Committed by

web-flow

Commit Message

Merge 3e61eca94 into 0a5939ecd

Pull Request Pull Request #4648: Refactor hash2curve expand_message

Run Details

94439 of 103463 relevant lines covered (91.28%)

11252010.8 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

96.86

/src/lib/pubkey/ec_group/ec_inner_data.cpp

/*
* (C) 2024 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/internal/ec_inner_data.h>

#include <botan/der_enc.h>
#include <botan/internal/ec_inner_pc.h>
#include <botan/internal/fmt.h>
#include <botan/internal/pcurves.h>

#if defined(BOTAN_HAS_LEGACY_EC_POINT)
   #include <botan/internal/ec_inner_bn.h>
   #include <botan/internal/point_mul.h>
#endif

#if defined(BOTAN_HAS_XMD)
   #include <botan/internal/xmd.h>
#endif

namespace Botan {

EC_Group_Data::~EC_Group_Data() = default;

// Note this constructor *does not* initialize m_curve, m_base_point or m_base_mult
EC_Group_Data::EC_Group_Data(const BigInt& p,
                             const BigInt& a,
                             const BigInt& b,
                             const BigInt& g_x,
                             const BigInt& g_y,
                             const BigInt& order,
                             const BigInt& cofactor,
                             const OID& oid,
                             EC_Group_Source source) :
      m_p(p),
      m_a(a),
      m_b(b),
      m_g_x(g_x),
      m_g_y(g_y),
      m_order(order),
      m_cofactor(cofactor),
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      m_mod_field(Modular_Reducer::for_public_modulus(p)),
      m_mod_order(Modular_Reducer::for_public_modulus(order)),
      m_monty(m_p, m_mod_field),
#endif
      m_oid(oid),
      m_p_words(p.sig_words()),
      m_p_bits(p.bits()),
      m_order_bits(order.bits()),
      m_order_bytes((m_order_bits + 7) / 8),
      m_a_is_minus_3(a == p - 3),
      m_a_is_zero(a.is_zero()),
      m_has_cofactor(m_cofactor != 1),
      m_order_is_less_than_p(m_order < p),
      m_source(source) {
   if(!m_oid.empty()) {
      DER_Encoder der(m_der_named_curve);
      der.encode(m_oid);

      if(const auto id = PCurve::PrimeOrderCurveId::from_oid(m_oid)) {
         m_pcurve = PCurve::PrimeOrderCurve::from_id(*id);
         if(m_pcurve) {
            m_engine = EC_Group_Engine::Optimized;
         }
         // still possibly null, if the curve is supported in general but not
         // available in the build
      }
   }

#if defined(BOTAN_HAS_LEGACY_EC_POINT)
   secure_vector<word> ws;
   m_a_r = m_monty.mul(a, m_monty.R2(), ws);
   m_b_r = m_monty.mul(b, m_monty.R2(), ws);
   if(!m_pcurve) {
      m_engine = EC_Group_Engine::Legacy;
   }
#else
   if(!m_pcurve) {
      if(m_oid.empty()) {
         throw Not_Implemented("EC_Group this group is not supported in this build configuration");
      } else {
         throw Not_Implemented(
            fmt("EC_Group the group {} is not supported in this build configuration", oid.to_string()));
      }
   }
#endif
}

std::shared_ptr<EC_Group_Data> EC_Group_Data::create(const BigInt& p,
                                                     const BigInt& a,
                                                     const BigInt& b,
                                                     const BigInt& g_x,
                                                     const BigInt& g_y,
                                                     const BigInt& order,
                                                     const BigInt& cofactor,
                                                     const OID& oid,
                                                     EC_Group_Source source) {
   auto group = std::make_shared<EC_Group_Data>(p, a, b, g_x, g_y, order, cofactor, oid, source);

#if defined(BOTAN_HAS_LEGACY_EC_POINT)
   group->m_curve = CurveGFp(group.get());
   group->m_base_point = EC_Point(group->m_curve, g_x, g_y);
   if(!group->m_pcurve) {
      group->m_base_mult = std::make_unique<EC_Point_Base_Point_Precompute>(group->m_base_point, group->m_mod_order);
   }
#endif

   return group;
}

bool EC_Group_Data::params_match(const BigInt& p,
                                 const BigInt& a,
                                 const BigInt& b,
                                 const BigInt& g_x,
                                 const BigInt& g_y,
                                 const BigInt& order,
                                 const BigInt& cofactor) const {
   return (this->p() == p && this->a() == a && this->b() == b && this->order() == order &&
           this->cofactor() == cofactor && this->g_x() == g_x && this->g_y() == g_y);
}

bool EC_Group_Data::params_match(const EC_Group_Data& other) const {
   return params_match(other.p(), other.a(), other.b(), other.g_x(), other.g_y(), other.order(), other.cofactor());
}

void EC_Group_Data::set_oid(const OID& oid) {
   BOTAN_ARG_CHECK(!oid.empty(), "OID should be set");
   BOTAN_STATE_CHECK(m_oid.empty() && m_der_named_curve.empty());
   m_oid = oid;

   DER_Encoder der(m_der_named_curve);
   der.encode(m_oid);
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_from_bytes_with_trunc(std::span<const uint8_t> bytes) const {
   const size_t bit_length = 8 * bytes.size();

   if(bit_length < order_bits()) {
      // No shifting required, but might still need to reduce by modulus
      return this->scalar_from_bytes_mod_order(bytes);
   } else {
      const size_t shift = bit_length - order_bits();

      const size_t new_length = bytes.size() - (shift / 8);
      const size_t bit_shift = shift % 8;

      if(bit_shift == 0) {
         // Easy case just read different bytes
         return this->scalar_from_bytes_mod_order(bytes.first(new_length));
      } else {
         std::vector<uint8_t> sbytes(new_length);

         uint8_t carry = 0;
         for(size_t i = 0; i != new_length; ++i) {
            const uint8_t w = bytes[i];
            sbytes[i] = (w >> bit_shift) | carry;
            carry = w << (8 - bit_shift);
         }

         return this->scalar_from_bytes_mod_order(sbytes);
      }
   }
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_from_bytes_mod_order(std::span<const uint8_t> bytes) const {
   if(bytes.size() > 2 * order_bytes()) {
      return {};
   }

   if(m_pcurve) {
      if(auto s = m_pcurve->scalar_from_wide_bytes(bytes)) {
         return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), std::move(*s));
      } else {
         return {};
      }
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), m_mod_order.reduce(BigInt(bytes)));
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_random(RandomNumberGenerator& rng) const {
   if(m_pcurve) {
      return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), m_pcurve->random_scalar(rng));
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(),
                                                 BigInt::random_integer(rng, BigInt::one(), m_order));
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_one() const {
   if(m_pcurve) {
      return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), m_pcurve->scalar_one());
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), BigInt::one());
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_from_bigint(const BigInt& bn) const {
   if(bn <= 0 || bn >= m_order) {
      return {};
   }

   if(m_pcurve) {
      return this->scalar_deserialize(bn.serialize(m_order_bytes));
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), bn);
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::gk_x_mod_order(const EC_Scalar_Data& scalar,
                                                              RandomNumberGenerator& rng,
                                                              std::vector<BigInt>& ws) const {
   if(m_pcurve) {
      const auto& k = EC_Scalar_Data_PC::checked_ref(scalar);
      auto gk_x_mod_order = m_pcurve->base_point_mul_x_mod_order(k.value(), rng);
      return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), gk_x_mod_order);
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      const auto& k = EC_Scalar_Data_BN::checked_ref(scalar);
      BOTAN_STATE_CHECK(m_base_mult != nullptr);
      const auto pt = m_base_mult->mul(k.value(), rng, m_order, ws);

      if(pt.is_zero()) {
         return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), BigInt::zero());
      } else {
         return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), m_mod_order.reduce(pt.get_affine_x()));
      }
#else
      BOTAN_UNUSED(ws);
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_deserialize(std::span<const uint8_t> bytes) const {
   if(bytes.size() != m_order_bytes) {
      return nullptr;
   }

   if(m_pcurve) {
      if(auto s = m_pcurve->deserialize_scalar(bytes)) {
         return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), *s);
      } else {
         return nullptr;
      }
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      BigInt r(bytes);

      if(r.is_zero() || r >= m_order) {
         return nullptr;
      }

      return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), std::move(r));
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_deserialize(std::span<const uint8_t> bytes) const {
   // The deprecated "hybrid" point format
   // TODO(Botan4) remove this
   if(bytes.size() >= 1 + 2 * 4 && (bytes[0] == 0x06 || bytes[0] == 0x07)) {
      bool hdr_y_is_even = bytes[0] == 0x06;
      bool y_is_even = (bytes.back() & 0x01) == 0;

      if(hdr_y_is_even == y_is_even) {
         std::vector<uint8_t> sec1(bytes.begin(), bytes.end());
         sec1[0] = 0x04;
         return this->point_deserialize(sec1);
      }
   }

   try {
      if(m_pcurve) {
         if(auto pt = m_pcurve->deserialize_point(bytes)) {
            return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(*pt));
         } else {
            return {};
         }
      } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
         auto pt = Botan::OS2ECP(bytes, m_curve);
         return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));
#else
         throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
      }
   } catch(...) {
      return {};
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_hash_to_curve_ro(std::string_view hash_fn,
                                                                           std::span<const uint8_t> input,
                                                                           std::span<const uint8_t> domain_sep) const {
   if(m_pcurve) {
      // This could be extended to support expand_message_xof or a MHF like Argon2
      auto expand_message = [&](std::span<uint8_t> xmd) {
#if defined(BOTAN_HAS_XMD)
         expand_message_xmd(hash_fn, xmd, input, domain_sep);
#else
         BOTAN_UNUSED(hash_fn, xmd, input, domain_sep);
         throw Not_Implemented("Hash to curve is not implemented due to XMD being disabled");
#endif
      };

      auto pt = m_pcurve->hash_to_curve_ro(expand_message);
      return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), m_pcurve->point_to_affine(pt));
   } else {
      throw Not_Implemented("Hash to curve is not implemented for this curve");
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_hash_to_curve_nu(std::string_view hash_fn,
                                                                           std::span<const uint8_t> input,
                                                                           std::span<const uint8_t> domain_sep) const {
   if(m_pcurve) {
      // This could be extended to support expand_message_xof or a MHF like Argon2
      auto expand_message = [&](std::span<uint8_t> xmd) {
#if defined(BOTAN_HAS_XMD)
         expand_message_xmd(hash_fn, xmd, input, domain_sep);
#else
         BOTAN_UNUSED(hash_fn, xmd, input, domain_sep);
         throw Not_Implemented("Hash to curve is not implemented due to XMD being disabled");
#endif
      };

      auto pt = m_pcurve->hash_to_curve_nu(expand_message);
      return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(pt));
   } else {
      throw Not_Implemented("Hash to curve is not implemented for this curve");
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_g_mul(const EC_Scalar_Data& scalar,
                                                                RandomNumberGenerator& rng,
                                                                std::vector<BigInt>& ws) const {
   if(m_pcurve) {
      const auto& k = EC_Scalar_Data_PC::checked_ref(scalar);
      auto pt = m_pcurve->point_to_affine(m_pcurve->mul_by_g(k.value(), rng));
      return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(pt));
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      const auto& group = scalar.group();
      const auto& bn = EC_Scalar_Data_BN::checked_ref(scalar);

      BOTAN_STATE_CHECK(group->m_base_mult != nullptr);
      auto pt = group->m_base_mult->mul(bn.value(), rng, m_order, ws);
      return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));
#else
      BOTAN_UNUSED(ws);
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::mul_px_qy(const EC_AffinePoint_Data& p,
                                                              const EC_Scalar_Data& x,
                                                              const EC_AffinePoint_Data& q,
                                                              const EC_Scalar_Data& y,
                                                              RandomNumberGenerator& rng) const {
   if(m_pcurve) {
      auto pt = m_pcurve->mul_px_qy(EC_AffinePoint_Data_PC::checked_ref(p).value(),
                                    EC_Scalar_Data_PC::checked_ref(x).value(),
                                    EC_AffinePoint_Data_PC::checked_ref(q).value(),
                                    EC_Scalar_Data_PC::checked_ref(y).value(),
                                    rng);

      if(pt) {
         return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), m_pcurve->point_to_affine(*pt));
      } else {
         return nullptr;
      }
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      std::vector<BigInt> ws;
      const auto& group = p.group();

      // TODO this could be better!
      EC_Point_Var_Point_Precompute p_mul(p.to_legacy_point(), rng, ws);
      EC_Point_Var_Point_Precompute q_mul(q.to_legacy_point(), rng, ws);

      const auto order = group->order() * group->cofactor();  // See #3800

      auto px = p_mul.mul(EC_Scalar_Data_BN::checked_ref(x).value(), rng, order, ws);
      auto qy = q_mul.mul(EC_Scalar_Data_BN::checked_ref(y).value(), rng, order, ws);

      auto px_qy = px + qy;

      if(!px_qy.is_zero()) {
         px_qy.force_affine();
         return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(px_qy));
      } else {
         return nullptr;
      }
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::affine_add(const EC_AffinePoint_Data& p,
                                                               const EC_AffinePoint_Data& q) const {
   if(m_pcurve) {
      auto pt = m_pcurve->point_add(EC_AffinePoint_Data_PC::checked_ref(p).value(),
                                    EC_AffinePoint_Data_PC::checked_ref(q).value());

      return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), m_pcurve->point_to_affine(pt));
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      auto pt = p.to_legacy_point() + q.to_legacy_point();
      return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::affine_neg(const EC_AffinePoint_Data& p) const {
   if(m_pcurve) {
      auto pt = m_pcurve->point_negate(EC_AffinePoint_Data_PC::checked_ref(p).value());
      return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), pt);
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      auto pt = p.to_legacy_point();
      pt.negate();  // negates in place
      return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

std::unique_ptr<EC_Mul2Table_Data> EC_Group_Data::make_mul2_table(const EC_AffinePoint_Data& h) const {
   if(m_pcurve) {
      return std::make_unique<EC_Mul2Table_Data_PC>(h);
   } else {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
      EC_AffinePoint_Data_BN g(shared_from_this(), this->base_point());
      return std::make_unique<EC_Mul2Table_Data_BN>(g, h);
#else
      throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
#endif
   }
}

}  // namespace Botan

1	/*
2	* (C) 2024 Jack Lloyd
3	*
4	* Botan is released under the Simplified BSD License (see license.txt)
5	*/
6
7	#include <botan/internal/ec_inner_data.h>
8
9	#include <botan/der_enc.h>
10	#include <botan/internal/ec_inner_pc.h>
11	#include <botan/internal/fmt.h>
12	#include <botan/internal/pcurves.h>
13
14	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
15	#include <botan/internal/ec_inner_bn.h>
16	#include <botan/internal/point_mul.h>
17	#endif
18
19	#if defined(BOTAN_HAS_XMD)
20	#include <botan/internal/xmd.h>
21	#endif
22
23	namespace Botan {
24
25	EC_Group_Data::~EC_Group_Data() = default;	13,939✔
26
27	// Note this constructor does not initialize m_curve, m_base_point or m_base_mult
28	EC_Group_Data::EC_Group_Data(const BigInt& p,	1,162✔
29	const BigInt& a,
30	const BigInt& b,
31	const BigInt& g_x,
32	const BigInt& g_y,
33	const BigInt& order,
34	const BigInt& cofactor,
35	const OID& oid,
36	EC_Group_Source source) :	1,162✔
37	m_p(p),	1,162✔
38	m_a(a),	1,162✔
39	m_b(b),	1,162✔
40	m_g_x(g_x),	1,162✔
41	m_g_y(g_y),	1,162✔
42	m_order(order),	1,162✔
43	m_cofactor(cofactor),	1,162✔
44	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
45	m_mod_field(Modular_Reducer::for_public_modulus(p)),	1,162✔
46	m_mod_order(Modular_Reducer::for_public_modulus(order)),	1,162✔
47	m_monty(m_p, m_mod_field),	1,162✔
48	#endif
49	m_oid(oid),	1,162✔
50	m_p_words(p.sig_words()),	1,162✔
51	m_p_bits(p.bits()),	1,162✔
52	m_order_bits(order.bits()),	1,162✔
53	m_order_bytes((m_order_bits + 7) / 8),	1,162✔
54	m_a_is_minus_3(a == p - 3),	2,324✔
55	m_a_is_zero(a.is_zero()),	1,162✔
56	m_has_cofactor(m_cofactor != 1),	1,162✔
57	m_order_is_less_than_p(m_order < p),	1,162✔
58	m_source(source) {	3,486✔
59	if(!m_oid.empty()) {	1,162✔
60	DER_Encoder der(m_der_named_curve);	1,152✔
61	der.encode(m_oid);	1,152✔
62
63	if(const auto id = PCurve::PrimeOrderCurveId::from_oid(m_oid)) {	1,152✔
64	m_pcurve = PCurve::PrimeOrderCurve::from_id(*id);	913✔
65	if(m_pcurve) {	913✔
66	m_engine = EC_Group_Engine::Optimized;	913✔
67	}
68	// still possibly null, if the curve is supported in general but not
69	// available in the build
70	}
71	}	1,152✔
72
73	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
74	secure_vector<word> ws;	1,162✔
75	m_a_r = m_monty.mul(a, m_monty.R2(), ws);	2,324✔
76	m_b_r = m_monty.mul(b, m_monty.R2(), ws);	2,324✔
77	if(!m_pcurve) {	1,162✔
78	m_engine = EC_Group_Engine::Legacy;	249✔
79	}
80	#else
81	if(!m_pcurve) {
82	if(m_oid.empty()) {
83	throw Not_Implemented("EC_Group this group is not supported in this build configuration");
84	} else {
85	throw Not_Implemented(
86	fmt("EC_Group the group {} is not supported in this build configuration", oid.to_string()));
87	}
88	}
89	#endif
90	}	1,162✔
91
92	std::shared_ptr<EC_Group_Data> EC_Group_Data::create(const BigInt& p,	1,162✔
93	const BigInt& a,
94	const BigInt& b,
95	const BigInt& g_x,
96	const BigInt& g_y,
97	const BigInt& order,
98	const BigInt& cofactor,
99	const OID& oid,
100	EC_Group_Source source) {
101	auto group = std::make_shared<EC_Group_Data>(p, a, b, g_x, g_y, order, cofactor, oid, source);	1,162✔
102
103	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
104	group->m_curve = CurveGFp(group.get());	1,162✔
105	group->m_base_point = EC_Point(group->m_curve, g_x, g_y);	2,324✔
106	if(!group->m_pcurve) {	1,162✔
107	group->m_base_mult = std::make_unique<EC_Point_Base_Point_Precompute>(group->m_base_point, group->m_mod_order);	249✔
108	}
109	#endif
110
111	return group;	1,162✔
112	}	×
113
114	bool EC_Group_Data::params_match(const BigInt& p,	853✔
115	const BigInt& a,
116	const BigInt& b,
117	const BigInt& g_x,
118	const BigInt& g_y,
119	const BigInt& order,
120	const BigInt& cofactor) const {
121	return (this->p() == p && this->a() == a && this->b() == b && this->order() == order &&	945✔
122	this->cofactor() == cofactor && this->g_x() == g_x && this->g_y() == g_y);	936✔
123	}
124
125	bool EC_Group_Data::params_match(const EC_Group_Data& other) const {	19✔
126	return params_match(other.p(), other.a(), other.b(), other.g_x(), other.g_y(), other.order(), other.cofactor());	19✔
127	}
128
129	void EC_Group_Data::set_oid(const OID& oid) {	5✔
130	BOTAN_ARG_CHECK(!oid.empty(), "OID should be set");	5✔
131	BOTAN_STATE_CHECK(m_oid.empty() && m_der_named_curve.empty());	5✔
132	m_oid = oid;	5✔
133
134	DER_Encoder der(m_der_named_curve);	5✔
135	der.encode(m_oid);	5✔
136	}	5✔
137
138	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_from_bytes_with_trunc(std::span<const uint8_t> bytes) const {	26,073✔
139	const size_t bit_length = 8 * bytes.size();	26,073✔
140
141	if(bit_length < order_bits()) {	26,073✔
142	// No shifting required, but might still need to reduce by modulus
143	return this->scalar_from_bytes_mod_order(bytes);	5,248✔
144	} else {
145	const size_t shift = bit_length - order_bits();	20,825✔
146
147	const size_t new_length = bytes.size() - (shift / 8);	20,825✔
148	const size_t bit_shift = shift % 8;	20,825✔
149
150	if(bit_shift == 0) {	20,825✔
151	// Easy case just read different bytes
152	return this->scalar_from_bytes_mod_order(bytes.first(new_length));	18,181✔
153	} else {
154	std::vector<uint8_t> sbytes(new_length);	2,644✔
155
156	uint8_t carry = 0;	2,644✔
157	for(size_t i = 0; i != new_length; ++i) {	72,236✔
158	const uint8_t w = bytes[i];	69,592✔
159	sbytes[i] = (w >> bit_shift) \| carry;	69,592✔
160	carry = w << (8 - bit_shift);	69,592✔
161	}
162
163	return this->scalar_from_bytes_mod_order(sbytes);	2,644✔
164	}	2,644✔
165	}
166	}
167
168	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_from_bytes_mod_order(std::span<const uint8_t> bytes) const {	34,788✔
169	if(bytes.size() > 2 * order_bytes()) {	34,788✔
170	return {};	×
171	}
172
173	if(m_pcurve) {	34,788✔
174	if(auto s = m_pcurve->scalar_from_wide_bytes(bytes)) {	23,525✔
175	return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), std::move(*s));	23,525✔
176	} else {
177	return {};	×
178	}	23,525✔
179	} else {
180	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
181	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), m_mod_order.reduce(BigInt(bytes)));	22,526✔
182	#else
183	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
184	#endif
185	}
186	}
187
188	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_random(RandomNumberGenerator& rng) const {	44,415✔
189	if(m_pcurve) {	44,415✔
190	return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), m_pcurve->random_scalar(rng));	19,609✔
191	} else {
192	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
193	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(),	49,612✔
194	BigInt::random_integer(rng, BigInt::one(), m_order));	99,224✔
195	#else
196	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
197	#endif
198	}
199	}
200
201	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_one() const {	101✔
202	if(m_pcurve) {	101✔
203	return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), m_pcurve->scalar_one());	61✔
204	} else {
205	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
206	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), BigInt::one());	40✔
207	#else
208	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
209	#endif
210	}
211	}
212
213	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_from_bigint(const BigInt& bn) const {	4,485✔
214	if(bn <= 0 \|\| bn >= m_order) {	4,485✔
215	return {};	×
216	}
217
218	if(m_pcurve) {	4,485✔
219	return this->scalar_deserialize(bn.serialize(m_order_bytes));	6,754✔
220	} else {
221	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
222	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), bn);	1,108✔
223	#else
224	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
225	#endif
226	}
227	}
228
229	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::gk_x_mod_order(const EC_Scalar_Data& scalar,	3,314✔
230	RandomNumberGenerator& rng,
231	std::vector<BigInt>& ws) const {
232	if(m_pcurve) {	3,314✔
233	const auto& k = EC_Scalar_Data_PC::checked_ref(scalar);	1,693✔
234	auto gk_x_mod_order = m_pcurve->base_point_mul_x_mod_order(k.value(), rng);	1,693✔
235	return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), gk_x_mod_order);	1,693✔
236	} else {	1,693✔
237	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
238	const auto& k = EC_Scalar_Data_BN::checked_ref(scalar);	1,621✔
239	BOTAN_STATE_CHECK(m_base_mult != nullptr);	1,621✔
240	const auto pt = m_base_mult->mul(k.value(), rng, m_order, ws);	1,621✔
241
242	if(pt.is_zero()) {	3,242✔
243	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), BigInt::zero());	×
244	} else {
245	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), m_mod_order.reduce(pt.get_affine_x()));	3,242✔
246	}
247	#else
248	BOTAN_UNUSED(ws);
249	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
250	#endif
251	}	1,621✔
252	}
253
254	std::unique_ptr<EC_Scalar_Data> EC_Group_Data::scalar_deserialize(std::span<const uint8_t> bytes) const {	68,682✔
255	if(bytes.size() != m_order_bytes) {	68,682✔
256	return nullptr;	5,822✔
257	}
258
259	if(m_pcurve) {	62,860✔
260	if(auto s = m_pcurve->deserialize_scalar(bytes)) {	46,866✔
261	return std::make_unique<EC_Scalar_Data_PC>(shared_from_this(), *s);	44,692✔
262	} else {
263	return nullptr;	2,174✔
264	}	46,866✔
265	} else {
266	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
267	BigInt r(bytes);	15,994✔
268
269	if(r.is_zero() \|\| r >= m_order) {	31,988✔
270	return nullptr;	761✔
271	}
272
273	return std::make_unique<EC_Scalar_Data_BN>(shared_from_this(), std::move(r));	15,233✔
274	#else
275	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
276	#endif
277	}	15,994✔
278	}
279
280	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_deserialize(std::span<const uint8_t> bytes) const {	44,571✔
281	// The deprecated "hybrid" point format
282	// TODO(Botan4) remove this
283	if(bytes.size() >= 1 + 2 * 4 && (bytes[0] == 0x06 \|\| bytes[0] == 0x07)) {	44,571✔
284	bool hdr_y_is_even = bytes[0] == 0x06;	207✔
285	bool y_is_even = (bytes.back() & 0x01) == 0;	207✔
286
287	if(hdr_y_is_even == y_is_even) {	207✔
288	std::vector<uint8_t> sec1(bytes.begin(), bytes.end());	147✔
289	sec1[0] = 0x04;	147✔
290	return this->point_deserialize(sec1);	147✔
291	}	147✔
292	}
293
294	try {	44,424✔
295	if(m_pcurve) {	44,424✔
296	if(auto pt = m_pcurve->deserialize_point(bytes)) {	33,035✔
297	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(*pt));	26,918✔
298	} else {
299	return {};	6,117✔
300	}	33,035✔
301	} else {
302	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
303	auto pt = Botan::OS2ECP(bytes, m_curve);	11,389✔
304	return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));	11,132✔
305	#else
306	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
307	#endif
308	}	11,132✔
309	} catch(...) {	257✔
310	return {};	257✔
311	}	257✔
312	}
313
314	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_hash_to_curve_ro(std::string_view hash_fn,	25✔
315	std::span<const uint8_t> input,
316	std::span<const uint8_t> domain_sep) const {
317	if(m_pcurve) {	25✔
318	// This could be extended to support expand_message_xof or a MHF like Argon2
319	auto expand_message = [&](std::span<uint8_t> xmd) {	50✔
320	#if defined(BOTAN_HAS_XMD)
321	expand_message_xmd(hash_fn, xmd, input, domain_sep);	25✔
322	#else
323	BOTAN_UNUSED(hash_fn, xmd, input, domain_sep);
324	throw Not_Implemented("Hash to curve is not implemented due to XMD being disabled");
325	#endif
326	};	25✔
327
328	auto pt = m_pcurve->hash_to_curve_ro(expand_message);	25✔
329	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), m_pcurve->point_to_affine(pt));	25✔
330	} else {	25✔
331	throw Not_Implemented("Hash to curve is not implemented for this curve");	×
332	}
333	}
334
335	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_hash_to_curve_nu(std::string_view hash_fn,	34✔
336	std::span<const uint8_t> input,
337	std::span<const uint8_t> domain_sep) const {
338	if(m_pcurve) {	34✔
339	// This could be extended to support expand_message_xof or a MHF like Argon2
340	auto expand_message = [&](std::span<uint8_t> xmd) {	65✔
341	#if defined(BOTAN_HAS_XMD)
342	expand_message_xmd(hash_fn, xmd, input, domain_sep);	31✔
343	#else
344	BOTAN_UNUSED(hash_fn, xmd, input, domain_sep);
345	throw Not_Implemented("Hash to curve is not implemented due to XMD being disabled");
346	#endif
347	};	34✔
348
349	auto pt = m_pcurve->hash_to_curve_nu(expand_message);	37✔
350	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(pt));	31✔
351	} else {	31✔
352	throw Not_Implemented("Hash to curve is not implemented for this curve");	×
353	}
354	}
355
356	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_g_mul(const EC_Scalar_Data& scalar,	15,375✔
357	RandomNumberGenerator& rng,
358	std::vector<BigInt>& ws) const {
359	if(m_pcurve) {	15,375✔
360	const auto& k = EC_Scalar_Data_PC::checked_ref(scalar);	7,982✔
361	auto pt = m_pcurve->point_to_affine(m_pcurve->mul_by_g(k.value(), rng));	7,982✔
362	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(pt));	7,982✔
363	} else {	7,982✔
364	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
365	const auto& group = scalar.group();	7,393✔
366	const auto& bn = EC_Scalar_Data_BN::checked_ref(scalar);	7,393✔
367
368	BOTAN_STATE_CHECK(group->m_base_mult != nullptr);	7,393✔
369	auto pt = group->m_base_mult->mul(bn.value(), rng, m_order, ws);	7,393✔
370	return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));	7,393✔
371	#else
372	BOTAN_UNUSED(ws);
373	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
374	#endif
375	}	7,393✔
376	}
377
378	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::mul_px_qy(const EC_AffinePoint_Data& p,	3,472✔
379	const EC_Scalar_Data& x,
380	const EC_AffinePoint_Data& q,
381	const EC_Scalar_Data& y,
382	RandomNumberGenerator& rng) const {
383	if(m_pcurve) {	3,472✔
384	auto pt = m_pcurve->mul_px_qy(EC_AffinePoint_Data_PC::checked_ref(p).value(),	5,208✔
385	EC_Scalar_Data_PC::checked_ref(x).value(),	2,604✔
386	EC_AffinePoint_Data_PC::checked_ref(q).value(),	2,604✔
387	EC_Scalar_Data_PC::checked_ref(y).value(),	2,604✔
388	rng);	2,604✔
389
390	if(pt) {	2,604✔
391	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), m_pcurve->point_to_affine(*pt));	2,520✔
392	} else {
393	return nullptr;	84✔
394	}
395	} else {	2,604✔
396	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
397	std::vector<BigInt> ws;	868✔
398	const auto& group = p.group();	868✔
399
400	// TODO this could be better!
401	EC_Point_Var_Point_Precompute p_mul(p.to_legacy_point(), rng, ws);	868✔
402	EC_Point_Var_Point_Precompute q_mul(q.to_legacy_point(), rng, ws);	868✔
403
404	const auto order = group->order() * group->cofactor(); // See #3800	868✔
405
406	auto px = p_mul.mul(EC_Scalar_Data_BN::checked_ref(x).value(), rng, order, ws);	868✔
407	auto qy = q_mul.mul(EC_Scalar_Data_BN::checked_ref(y).value(), rng, order, ws);	868✔
408
409	auto px_qy = px + qy;	868✔
410
411	if(!px_qy.is_zero()) {	1,624✔
412	px_qy.force_affine();	756✔
413	return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(px_qy));	756✔
414	} else {
415	return nullptr;	112✔
416	}
417	#else
418	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
419	#endif
420	}	3,472✔
421	}
422
423	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::affine_add(const EC_AffinePoint_Data& p,	7,754✔
424	const EC_AffinePoint_Data& q) const {
425	if(m_pcurve) {	7,754✔
426	auto pt = m_pcurve->point_add(EC_AffinePoint_Data_PC::checked_ref(p).value(),	5,046✔
427	EC_AffinePoint_Data_PC::checked_ref(q).value());	5,046✔
428
429	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), m_pcurve->point_to_affine(pt));	5,045✔
430	} else {	5,045✔
431	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
432	auto pt = p.to_legacy_point() + q.to_legacy_point();	2,708✔
433	return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));	2,708✔
434	#else
435	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
436	#endif
437	}	2,708✔
438	}
439
440	std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::affine_neg(const EC_AffinePoint_Data& p) const {	9,512✔
441	if(m_pcurve) {	9,512✔
442	auto pt = m_pcurve->point_negate(EC_AffinePoint_Data_PC::checked_ref(p).value());	6,312✔
443	return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), pt);	6,312✔
444	} else {	6,312✔
445	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
446	auto pt = p.to_legacy_point();	3,200✔
447	pt.negate(); // negates in place	3,200✔
448	return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));	3,200✔
449	#else
450	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
451	#endif
452	}	3,200✔
453	}
454
455	std::unique_ptr<EC_Mul2Table_Data> EC_Group_Data::make_mul2_table(const EC_AffinePoint_Data& h) const {	13,261✔
456	if(m_pcurve) {	13,261✔
457	return std::make_unique<EC_Mul2Table_Data_PC>(h);	11,180✔
458	} else {
459	#if defined(BOTAN_HAS_LEGACY_EC_POINT)
460	EC_AffinePoint_Data_BN g(shared_from_this(), this->base_point());	4,162✔
461	return std::make_unique<EC_Mul2Table_Data_BN>(g, h);	2,081✔
462	#else
463	throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
464	#endif
465	}	2,081✔
466	}
467
468	} // namespace Botan

randombit / botan / 13209474962

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous