Added new define (uECC_SUPPORT_COMPRESSED_POINT) and new API functions.
diff --git a/curve-specific.inc b/curve-specific.inc
index 23a2395..60f5d18 100644
--- a/curve-specific.inc
+++ b/curve-specific.inc
@@ -97,6 +97,7 @@
vli_set(Y1, t4, curve->num_words);
}
+#if uECC_SUPPORT_COMPRESSED_POINT
/* Compute a = sqrt(a) (mod curve_p). */
static void mod_sqrt_default(uECC_word_t *a, uECC_Curve curve) {
bitcount_t i;
@@ -114,6 +115,7 @@
}
vli_set(a, l_result, curve->num_words);
}
+#endif
/* Computes result = x^3 + ax + b. result must not overlap x. */
static void x_side_default(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve) {
@@ -152,7 +154,9 @@
BYTES_TO_WORDS_8(9F, F8, AC, 65, 8B, 7A, BD, 54),
BYTES_TO_WORDS_4(FC, BE, 97, 1C) },
&double_jacobian_default,
+#if uECC_SUPPORT_COMPRESSED_POINT
&mod_sqrt_default,
+#endif
&x_side_default,
#if (uECC_OPTIMIZATION_LEVEL > 0)
&vli_mmod_fast_secp160r1
@@ -295,7 +299,9 @@
BYTES_TO_WORDS_8(49, 30, 24, 72, AB, E9, A7, 0F),
BYTES_TO_WORDS_8(E7, 80, 9C, E5, 19, 05, 21, 64) },
&double_jacobian_default,
+#if uECC_SUPPORT_COMPRESSED_POINT
&mod_sqrt_default,
+#endif
&x_side_default,
#if (uECC_OPTIMIZATION_LEVEL > 0)
&vli_mmod_fast_secp192r1
@@ -395,7 +401,9 @@
#if uECC_SUPPORTS_secp224r1
+#if uECC_SUPPORT_COMPRESSED_POINT
static void mod_sqrt_secp224r1(uECC_word_t *a, uECC_Curve curve);
+#endif
#if (uECC_OPTIMIZATION_LEVEL > 0)
static void vli_mmod_fast_secp224r1(uECC_word_t *result, uECC_word_t *product);
#endif
@@ -426,7 +434,9 @@
BYTES_TO_WORDS_8(56, 32, 41, F5, AB, B3, 04, 0C),
BYTES_TO_WORDS_4(85, 0A, 05, B4) },
&double_jacobian_default,
+#if uECC_SUPPORT_COMPRESSED_POINT
&mod_sqrt_secp224r1,
+#endif
&x_side_default,
#if (uECC_OPTIMIZATION_LEVEL > 0)
&vli_mmod_fast_secp224r1
@@ -436,6 +446,7 @@
uECC_Curve uECC_secp224r1(void) { return &curve_secp224r1; }
+#if uECC_SUPPORT_COMPRESSED_POINT
/* Routine 3.2.4 RS; from http://www.nsa.gov/ia/_files/nist-routines.pdf */
static void mod_sqrt_secp224r1_rs(uECC_word_t *d1,
uECC_word_t *e1,
@@ -536,7 +547,7 @@
uECC_word_t f0[num_words_secp224r1];
uECC_word_t d1[num_words_secp224r1];
- // s = a; using constant instead of random value
+ /* s = a; using constant instead of random value */
mod_sqrt_secp224r1_rp(d0, e0, f0, a, a); /* RP (d0, e0, f0, c, s) */
mod_sqrt_secp224r1_rs(d1, e1, f1, d0, e0, f0); /* RS (d1, e1, f1, d0, e0, f0) */
for (i = 1; i <= 95; i++) {
@@ -545,12 +556,13 @@
vli_set(f0, f1, num_words_secp224r1); /* f0 <-- f1 */
mod_sqrt_secp224r1_rs(d1, e1, f1, d0, e0, f0); /* RS (d1, e1, f1, d0, e0, f0) */
if (vli_isZero(d1, num_words_secp224r1)) { /* if d1 == 0 */
- break;
+ break;
}
}
vli_modInv(f1, e0, curve_secp224r1.p, num_words_secp224r1); /* f1 <-- 1 / e0 */
vli_modMult_fast(a, d0, f1, &curve_secp224r1); /* a <-- d0 / e0 */
}
+#endif /* uECC_SUPPORT_COMPRESSED_POINT */
#if (uECC_OPTIMIZATION_LEVEL > 0)
/* Computes result = product % curve_p
@@ -744,7 +756,9 @@
BYTES_TO_WORDS_8(BC, 86, 98, 76, 55, BD, EB, B3),
BYTES_TO_WORDS_8(E7, 93, 3A, AA, D8, 35, C6, 5A) },
&double_jacobian_default,
+#if uECC_SUPPORT_COMPRESSED_POINT
&mod_sqrt_default,
+#endif
&x_side_default,
#if (uECC_OPTIMIZATION_LEVEL > 0)
&vli_mmod_fast_secp256r1
@@ -1077,7 +1091,9 @@
BYTES_TO_WORDS_8(00, 00, 00, 00, 00, 00, 00, 00),
BYTES_TO_WORDS_8(00, 00, 00, 00, 00, 00, 00, 00) },
&double_jacobian_secp256k1,
+#if uECC_SUPPORT_COMPRESSED_POINT
&mod_sqrt_default,
+#endif
&x_side_secp256k1,
#if (uECC_OPTIMIZATION_LEVEL > 0)
&vli_mmod_fast_secp256k1
diff --git a/uECC.c b/uECC.c
index 8d8ad9f..534a80e 100644
--- a/uECC.c
+++ b/uECC.c
@@ -42,7 +42,9 @@
uECC_word_t * Y1,
uECC_word_t * Z1,
uECC_Curve curve);
+#if uECC_SUPPORT_COMPRESSED_POINT
void (*mod_sqrt)(uECC_word_t *a, uECC_Curve curve);
+#endif
void (*x_side)(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve);
#if (uECC_OPTIMIZATION_LEVEL > 0)
void (*mmod_fast)(uECC_word_t *result, uECC_word_t *product);
@@ -71,6 +73,7 @@
}
}
+/* Constant-time comparison to zero - secure way to compare long integers */
/* Returns 1 if vli == 0, 0 otherwise. */
static uECC_word_t vli_isZero(const uECC_word_t *vli, wordcount_t num_words) {
uECC_word_t bits = 0;
@@ -138,6 +141,8 @@
return 0;
}
+/* Constant-time comparison function - secure way to compare long integers */
+/* Returns one if left == right, zero otherwise */
static uECC_word_t vli_equal(const uECC_word_t *left,
const uECC_word_t *right,
wordcount_t num_words) {
@@ -200,7 +205,7 @@
}
#endif /* !asm_sub */
-#if !asm_mult || !asm_square || \
+#if !asm_mult || (uECC_SQUARE_FUNC && !asm_square) || \
(uECC_SUPPORTS_secp256k1 && (uECC_OPTIMIZATION_LEVEL > 0) && \
((uECC_WORD_SIZE == 1) || (uECC_WORD_SIZE == 8)))
static void muladd(uECC_word_t a,
@@ -569,9 +574,7 @@
#include "curve-specific.inc"
/* Returns 1 if 'point' is the point at infinity, 0 otherwise. */
-static cmpresult_t EccPoint_isZero(const uECC_word_t *point, uECC_Curve curve) {
- return vli_isZero(point, curve->num_words * 2);
-}
+#define EccPoint_isZero(point, curve) vli_isZero((point), (curve)->num_words * 2)
/* Point multiplication algorithm using Montgomery's ladder with co-Z coordinates.
From http://eprint.iacr.org/2011/338.pdf
@@ -854,7 +857,7 @@
if (!generate_random_int(private, curve->num_words, curve->num_bytes * 8)) {
return 0;
}
-
+
if (EccPoint_compute_public_key(public, private, curve)) {
vli_nativeToBytes(private_key, private, curve);
vli_nativeToBytes(public_key, public, curve);
@@ -911,6 +914,7 @@
return !EccPoint_isZero(public, curve);
}
+#if uECC_SUPPORT_COMPRESSED_POINT
void uECC_compress(const uint8_t *public_key, uint8_t *compressed, uECC_Curve curve) {
wordcount_t i;
for (i = 0; i < curve->num_bytes; ++i) {
@@ -933,33 +937,38 @@
vli_nativeToBytes(public_key, point, curve);
vli_nativeToBytes(public_key + curve->num_bytes, y, curve);
}
+#endif /* uECC_SUPPORT_COMPRESSED_POINT */
-int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve) {
+int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve) {
uECC_word_t tmp1[uECC_MAX_WORDS];
uECC_word_t tmp2[uECC_MAX_WORDS];
- uECC_word_t public[uECC_MAX_WORDS * 2];
-
- vli_bytesToNative(public, public_key, curve);
- vli_bytesToNative(public + curve->num_words, public_key + curve->num_bytes, curve);
-
+
/* The point at infinity is invalid. */
- if (EccPoint_isZero(public, curve)) {
+ if (EccPoint_isZero(point, curve)) {
return 0;
}
/* x and y must be smaller than p. */
- if (vli_cmp(curve->p, public, curve->num_words) != 1 ||
- vli_cmp(curve->p, public + curve->num_words, curve->num_words) != 1) {
+ if (vli_cmp(curve->p, point, curve->num_words) != 1 ||
+ vli_cmp(curve->p, point + curve->num_words, curve->num_words) != 1) {
return 0;
}
- vli_modSquare_fast(tmp1, public + curve->num_words, curve);
- curve->x_side(tmp2, public, curve); /* tmp2 = x^3 + ax + b */
+ vli_modSquare_fast(tmp1, point + curve->num_words, curve);
+ curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
/* Make sure that y^2 == x^3 + ax + b */
return (vli_equal(tmp1, tmp2, curve->num_words));
}
+int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve) {
+ uECC_word_t public[uECC_MAX_WORDS * 2];
+
+ vli_bytesToNative(public, public_key, curve);
+ vli_bytesToNative(public + curve->num_words, public_key + curve->num_bytes, curve);
+ return uECC_valid_point(public, curve);
+}
+
int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key, uECC_Curve curve) {
uECC_word_t private[uECC_MAX_WORDS];
uECC_word_t public[uECC_MAX_WORDS * 2];
@@ -1315,10 +1324,12 @@
return curve->b;
}
+#if uECC_SUPPORT_COMPRESSED_POINT
/* Calculates a = sqrt(a) (mod curve->p) */
void uECC_mod_sqrt(uECC_word_t *a, uECC_Curve curve) {
curve->mod_sqrt(a, curve);
}
+#endif
/* Calculates result = product (mod curve->p), where product is up to
2 * curve->num_words long. */
@@ -1330,6 +1341,14 @@
#endif
}
+void uECC_vli_nativeToBytes(uint8_t * dest, const uECC_word_t * src, uECC_Curve curve) {
+ vli_nativeToBytes(dest, src, curve);
+}
+
+void uECC_vli_bytesToNative(uECC_word_t * dest, const uint8_t * src, uECC_Curve curve) {
+ vli_bytesToNative(dest, src, curve);
+}
+
void uECC_vli_clear(uECC_word_t *vli, unsigned num_words) {
vli_clear(vli, num_words);
}
@@ -1432,8 +1451,8 @@
the Y coordinate in the same array, both coordinates are curve->num_words long. Note
that scalar must be curve->num_n_words long (NOT curve->num_words). */
void uECC_point_mult(uECC_word_t *result,
- uECC_word_t *point,
- uECC_word_t *scalar,
+ const uECC_word_t *point,
+ const uECC_word_t *scalar,
uECC_Curve curve) {
uECC_word_t tmp1[uECC_MAX_WORDS];
uECC_word_t tmp2[uECC_MAX_WORDS];
@@ -1444,3 +1463,25 @@
vli_numBits(curve->n, curve->num_n_words) + 1,
curve);
}
+
+/* Calculates result = product (mod curve->n), where product is up to
+ 2 * curve->num_n_words long. */
+void uECC_vli_mmod_n(uECC_word_t *result, uECC_word_t *product, uECC_Curve curve) {
+ vli_mmod(result, product, curve->n, curve->num_n_words);
+}
+
+/* Computes result = (left * right) % (curve->n). */
+void uECC_vli_modMult_n(uECC_word_t *result,
+ const uECC_word_t *left,
+ const uECC_word_t *right,
+ uECC_Curve curve) {
+ vli_modMult(result, left, right, curve->n, curve->num_n_words);
+}
+
+/* Computes result = (left * right) % (curve->p). */
+void uECC_vli_modMult_fast(uECC_word_t *result,
+ const uECC_word_t *left,
+ const uECC_word_t *right,
+ uECC_Curve curve) {
+ vli_modMult_fast(result, left, right, curve);
+}
diff --git a/uECC.h b/uECC.h
index 20d26d8..a5e97a0 100644
--- a/uECC.h
+++ b/uECC.h
@@ -49,6 +49,12 @@
#define uECC_SUPPORTS_secp256k1 1
#endif
+/* Specifies whether compressed point format is supported.
+ Set to 0 if compressed point is not supported. That saves code size. */
+#ifndef uECC_SUPPORT_COMPRESSED_POINT
+ #define uECC_SUPPORT_COMPRESSED_POINT 0
+#endif
+
struct uECC_Curve_t;
typedef const struct uECC_Curve_t * uECC_Curve;
@@ -133,6 +139,7 @@
uint8_t *secret,
uECC_Curve curve);
+#if uECC_SUPPORT_COMPRESSED_POINT
/* uECC_compress() function.
Compress a public key.
@@ -154,6 +161,7 @@
public_key - Will be filled in with the decompressed public key.
*/
void uECC_decompress(const uint8_t *compressed, uint8_t *public_key, uECC_Curve curve);
+#endif /* uECC_SUPPORT_COMPRESSED_POINT */
/* uECC_valid_public_key() function.
Check to see if a public key is valid.
