2
0

ectest.c 58 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456
  1. /*
  2. * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  4. *
  5. * Licensed under the OpenSSL license (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. */
  10. #include "internal/nelem.h"
  11. #include "testutil.h"
  12. #ifndef OPENSSL_NO_EC
  13. # include <openssl/ec.h>
  14. # ifndef OPENSSL_NO_ENGINE
  15. # include <openssl/engine.h>
  16. # endif
  17. # include <openssl/err.h>
  18. # include <openssl/obj_mac.h>
  19. # include <openssl/objects.h>
  20. # include <openssl/rand.h>
  21. # include <openssl/bn.h>
  22. # include <openssl/opensslconf.h>
  23. static size_t crv_len = 0;
  24. static EC_builtin_curve *curves = NULL;
  25. /* test multiplication with group order, long and negative scalars */
  26. static int group_order_tests(EC_GROUP *group)
  27. {
  28. BIGNUM *n1 = NULL, *n2 = NULL, *order = NULL;
  29. EC_POINT *P = NULL, *Q = NULL, *R = NULL, *S = NULL;
  30. BN_CTX *ctx = NULL;
  31. int i = 0, r = 0;
  32. if (!TEST_ptr(n1 = BN_new())
  33. || !TEST_ptr(n2 = BN_new())
  34. || !TEST_ptr(order = BN_new())
  35. || !TEST_ptr(ctx = BN_CTX_new())
  36. || !TEST_ptr(P = EC_POINT_new(group))
  37. || !TEST_ptr(Q = EC_POINT_new(group))
  38. || !TEST_ptr(R = EC_POINT_new(group))
  39. || !TEST_ptr(S = EC_POINT_new(group)))
  40. goto err;
  41. if (!TEST_true(EC_GROUP_get_order(group, order, ctx))
  42. || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
  43. || !TEST_true(EC_POINT_is_at_infinity(group, Q))
  44. || !TEST_true(EC_GROUP_precompute_mult(group, ctx))
  45. || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
  46. || !TEST_true(EC_POINT_is_at_infinity(group, Q)))
  47. goto err;
  48. for (i = 1; i <= 2; i++) {
  49. const BIGNUM *scalars[6];
  50. const EC_POINT *points[6];
  51. if (!TEST_true(BN_set_word(n1, i))
  52. /*
  53. * If i == 1, P will be the predefined generator for which
  54. * EC_GROUP_precompute_mult has set up precomputation.
  55. */
  56. || !TEST_true(EC_POINT_mul(group, P, n1, NULL, NULL, ctx))
  57. || !TEST_true(BN_one(n1))
  58. /* n1 = 1 - order */
  59. || !TEST_true(BN_sub(n1, n1, order))
  60. || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n1, ctx))
  61. || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  62. /* n2 = 1 + order */
  63. || !TEST_true(BN_add(n2, order, BN_value_one()))
  64. || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
  65. || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  66. /* n2 = (1 - order) * (1 + order) = 1 - order^2 */
  67. || !TEST_true(BN_mul(n2, n1, n2, ctx))
  68. || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
  69. || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx)))
  70. goto err;
  71. /* n2 = order^2 - 1 */
  72. BN_set_negative(n2, 0);
  73. if (!TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
  74. /* Add P to verify the result. */
  75. || !TEST_true(EC_POINT_add(group, Q, Q, P, ctx))
  76. || !TEST_true(EC_POINT_is_at_infinity(group, Q))
  77. /* Exercise EC_POINTs_mul, including corner cases. */
  78. || !TEST_false(EC_POINT_is_at_infinity(group, P)))
  79. goto err;
  80. scalars[0] = scalars[1] = BN_value_one();
  81. points[0] = points[1] = P;
  82. if (!TEST_true(EC_POINTs_mul(group, R, NULL, 2, points, scalars, ctx))
  83. || !TEST_true(EC_POINT_dbl(group, S, points[0], ctx))
  84. || !TEST_int_eq(0, EC_POINT_cmp(group, R, S, ctx)))
  85. goto err;
  86. scalars[0] = n1;
  87. points[0] = Q; /* => infinity */
  88. scalars[1] = n2;
  89. points[1] = P; /* => -P */
  90. scalars[2] = n1;
  91. points[2] = Q; /* => infinity */
  92. scalars[3] = n2;
  93. points[3] = Q; /* => infinity */
  94. scalars[4] = n1;
  95. points[4] = P; /* => P */
  96. scalars[5] = n2;
  97. points[5] = Q; /* => infinity */
  98. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx))
  99. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  100. goto err;
  101. }
  102. r = 1;
  103. err:
  104. if (r == 0 && i != 0)
  105. TEST_info(i == 1 ? "allowing precomputation" :
  106. "without precomputation");
  107. EC_POINT_free(P);
  108. EC_POINT_free(Q);
  109. EC_POINT_free(R);
  110. EC_POINT_free(S);
  111. BN_free(n1);
  112. BN_free(n2);
  113. BN_free(order);
  114. BN_CTX_free(ctx);
  115. return r;
  116. }
  117. static int prime_field_tests(void)
  118. {
  119. BN_CTX *ctx = NULL;
  120. BIGNUM *p = NULL, *a = NULL, *b = NULL, *scalar3 = NULL;
  121. EC_GROUP *group = NULL, *tmp = NULL;
  122. EC_GROUP *P_160 = NULL, *P_192 = NULL, *P_224 = NULL,
  123. *P_256 = NULL, *P_384 = NULL, *P_521 = NULL;
  124. EC_POINT *P = NULL, *Q = NULL, *R = NULL;
  125. BIGNUM *x = NULL, *y = NULL, *z = NULL, *yplusone = NULL;
  126. const EC_POINT *points[4];
  127. const BIGNUM *scalars[4];
  128. unsigned char buf[100];
  129. size_t len, r = 0;
  130. int k;
  131. if (!TEST_ptr(ctx = BN_CTX_new())
  132. || !TEST_ptr(p = BN_new())
  133. || !TEST_ptr(a = BN_new())
  134. || !TEST_ptr(b = BN_new())
  135. || !TEST_true(BN_hex2bn(&p, "17"))
  136. || !TEST_true(BN_hex2bn(&a, "1"))
  137. || !TEST_true(BN_hex2bn(&b, "1"))
  138. /*
  139. * applications should use EC_GROUP_new_curve_GFp so
  140. * that the library gets to choose the EC_METHOD
  141. */
  142. || !TEST_ptr(group = EC_GROUP_new(EC_GFp_mont_method()))
  143. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  144. || !TEST_ptr(tmp = EC_GROUP_new(EC_GROUP_method_of(group)))
  145. || !TEST_true(EC_GROUP_copy(tmp, group)))
  146. goto err;
  147. EC_GROUP_free(group);
  148. group = tmp;
  149. tmp = NULL;
  150. if (!TEST_true(EC_GROUP_get_curve_GFp(group, p, a, b, ctx)))
  151. goto err;
  152. TEST_info("Curve defined by Weierstrass equation");
  153. TEST_note(" y^2 = x^3 + a*x + b (mod p)");
  154. test_output_bignum("a", a);
  155. test_output_bignum("b", b);
  156. test_output_bignum("p", p);
  157. buf[0] = 0;
  158. if (!TEST_ptr(P = EC_POINT_new(group))
  159. || !TEST_ptr(Q = EC_POINT_new(group))
  160. || !TEST_ptr(R = EC_POINT_new(group))
  161. || !TEST_true(EC_POINT_set_to_infinity(group, P))
  162. || !TEST_true(EC_POINT_is_at_infinity(group, P))
  163. || !TEST_true(EC_POINT_oct2point(group, Q, buf, 1, ctx))
  164. || !TEST_true(EC_POINT_add(group, P, P, Q, ctx))
  165. || !TEST_true(EC_POINT_is_at_infinity(group, P))
  166. || !TEST_ptr(x = BN_new())
  167. || !TEST_ptr(y = BN_new())
  168. || !TEST_ptr(z = BN_new())
  169. || !TEST_ptr(yplusone = BN_new())
  170. || !TEST_true(BN_hex2bn(&x, "D"))
  171. || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1,
  172. ctx)))
  173. goto err;
  174. if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
  175. if (!TEST_true(EC_POINT_get_affine_coordinates_GFp(group, Q, x, y,
  176. ctx)))
  177. goto err;
  178. TEST_info("Point is not on curve");
  179. test_output_bignum("x", x);
  180. test_output_bignum("y", y);
  181. goto err;
  182. }
  183. TEST_note("A cyclic subgroup:");
  184. k = 100;
  185. do {
  186. if (!TEST_int_ne(k--, 0))
  187. goto err;
  188. if (EC_POINT_is_at_infinity(group, P)) {
  189. TEST_note(" point at infinity");
  190. } else {
  191. if (!TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y,
  192. ctx)))
  193. goto err;
  194. test_output_bignum("x", x);
  195. test_output_bignum("y", y);
  196. }
  197. if (!TEST_true(EC_POINT_copy(R, P))
  198. || !TEST_true(EC_POINT_add(group, P, P, Q, ctx)))
  199. goto err;
  200. } while (!EC_POINT_is_at_infinity(group, P));
  201. if (!TEST_true(EC_POINT_add(group, P, Q, R, ctx))
  202. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  203. goto err;
  204. len =
  205. EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED, buf,
  206. sizeof(buf), ctx);
  207. if (!TEST_size_t_ne(len, 0)
  208. || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
  209. || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
  210. goto err;
  211. test_output_memory("Generator as octet string, compressed form:",
  212. buf, len);
  213. len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
  214. buf, sizeof(buf), ctx);
  215. if (!TEST_size_t_ne(len, 0)
  216. || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
  217. || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
  218. goto err;
  219. test_output_memory("Generator as octet string, uncompressed form:",
  220. buf, len);
  221. len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID,
  222. buf, sizeof(buf), ctx);
  223. if (!TEST_size_t_ne(len, 0)
  224. || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
  225. || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
  226. goto err;
  227. test_output_memory("Generator as octet string, hybrid form:",
  228. buf, len);
  229. if (!TEST_true(EC_POINT_get_Jprojective_coordinates_GFp(group, R, x, y, z,
  230. ctx)))
  231. goto err;
  232. TEST_info("A representation of the inverse of that generator in");
  233. TEST_note("Jacobian projective coordinates");
  234. test_output_bignum("x", x);
  235. test_output_bignum("y", y);
  236. test_output_bignum("z", z);
  237. if (!TEST_true(EC_POINT_invert(group, P, ctx))
  238. || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
  239. /*
  240. * Curve secp160r1 (Certicom Research SEC 2 Version 1.0, section 2.4.2,
  241. * 2000) -- not a NIST curve, but commonly used
  242. */
  243. || !TEST_true(BN_hex2bn(&p, "FFFFFFFF"
  244. "FFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF"))
  245. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  246. || !TEST_true(BN_hex2bn(&a, "FFFFFFFF"
  247. "FFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC"))
  248. || !TEST_true(BN_hex2bn(&b, "1C97BEFC"
  249. "54BD7A8B65ACF89F81D4D4ADC565FA45"))
  250. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  251. || !TEST_true(BN_hex2bn(&x, "4A96B568"
  252. "8EF573284664698968C38BB913CBFC82"))
  253. || !TEST_true(BN_hex2bn(&y, "23a62855"
  254. "3168947d59dcc912042351377ac5fb32"))
  255. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  256. /*
  257. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  258. * and therefore setting the coordinates should fail.
  259. */
  260. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
  261. yplusone, ctx))
  262. || !TEST_true(EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
  263. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  264. || !TEST_true(BN_hex2bn(&z, "0100000000"
  265. "000000000001F4C8F927AED3CA752257"))
  266. || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
  267. || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
  268. goto err;
  269. TEST_info("SEC2 curve secp160r1 -- Generator");
  270. test_output_bignum("x", x);
  271. test_output_bignum("y", y);
  272. /* G_y value taken from the standard: */
  273. if (!TEST_true(BN_hex2bn(&z, "23a62855"
  274. "3168947d59dcc912042351377ac5fb32"))
  275. || !TEST_BN_eq(y, z)
  276. || !TEST_int_eq(EC_GROUP_get_degree(group), 160)
  277. || !group_order_tests(group)
  278. || !TEST_ptr(P_160 = EC_GROUP_new(EC_GROUP_method_of(group)))
  279. || !TEST_true(EC_GROUP_copy(P_160, group))
  280. /* Curve P-192 (FIPS PUB 186-2, App. 6) */
  281. || !TEST_true(BN_hex2bn(&p, "FFFFFFFFFFFFFFFF"
  282. "FFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF"))
  283. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  284. || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFF"
  285. "FFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC"))
  286. || !TEST_true(BN_hex2bn(&b, "64210519E59C80E7"
  287. "0FA7E9AB72243049FEB8DEECC146B9B1"))
  288. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  289. || !TEST_true(BN_hex2bn(&x, "188DA80EB03090F6"
  290. "7CBF20EB43A18800F4FF0AFD82FF1012"))
  291. || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1,
  292. ctx))
  293. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  294. || !TEST_true(BN_hex2bn(&z, "FFFFFFFFFFFFFFFF"
  295. "FFFFFFFF99DEF836146BC9B1B4D22831"))
  296. || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
  297. || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
  298. goto err;
  299. TEST_info("NIST curve P-192 -- Generator");
  300. test_output_bignum("x", x);
  301. test_output_bignum("y", y);
  302. /* G_y value taken from the standard: */
  303. if (!TEST_true(BN_hex2bn(&z, "07192B95FFC8DA78"
  304. "631011ED6B24CDD573F977A11E794811"))
  305. || !TEST_BN_eq(y, z)
  306. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  307. /*
  308. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  309. * and therefore setting the coordinates should fail.
  310. */
  311. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
  312. yplusone, ctx))
  313. || !TEST_int_eq(EC_GROUP_get_degree(group), 192)
  314. || !group_order_tests(group)
  315. || !TEST_ptr(P_192 = EC_GROUP_new(EC_GROUP_method_of(group)))
  316. || !TEST_true(EC_GROUP_copy(P_192, group))
  317. /* Curve P-224 (FIPS PUB 186-2, App. 6) */
  318. || !TEST_true(BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFF"
  319. "FFFFFFFF000000000000000000000001"))
  320. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  321. || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFF"
  322. "FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE"))
  323. || !TEST_true(BN_hex2bn(&b, "B4050A850C04B3ABF5413256"
  324. "5044B0B7D7BFD8BA270B39432355FFB4"))
  325. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  326. || !TEST_true(BN_hex2bn(&x, "B70E0CBD6BB4BF7F321390B9"
  327. "4A03C1D356C21122343280D6115C1D21"))
  328. || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0,
  329. ctx))
  330. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  331. || !TEST_true(BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF"
  332. "FFFF16A2E0B8F03E13DD29455C5C2A3D"))
  333. || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
  334. || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
  335. goto err;
  336. TEST_info("NIST curve P-224 -- Generator");
  337. test_output_bignum("x", x);
  338. test_output_bignum("y", y);
  339. /* G_y value taken from the standard: */
  340. if (!TEST_true(BN_hex2bn(&z, "BD376388B5F723FB4C22DFE6"
  341. "CD4375A05A07476444D5819985007E34"))
  342. || !TEST_BN_eq(y, z)
  343. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  344. /*
  345. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  346. * and therefore setting the coordinates should fail.
  347. */
  348. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
  349. yplusone, ctx))
  350. || !TEST_int_eq(EC_GROUP_get_degree(group), 224)
  351. || !group_order_tests(group)
  352. || !TEST_ptr(P_224 = EC_GROUP_new(EC_GROUP_method_of(group)))
  353. || !TEST_true(EC_GROUP_copy(P_224, group))
  354. /* Curve P-256 (FIPS PUB 186-2, App. 6) */
  355. || !TEST_true(BN_hex2bn(&p, "FFFFFFFF000000010000000000000000"
  356. "00000000FFFFFFFFFFFFFFFFFFFFFFFF"))
  357. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  358. || !TEST_true(BN_hex2bn(&a, "FFFFFFFF000000010000000000000000"
  359. "00000000FFFFFFFFFFFFFFFFFFFFFFFC"))
  360. || !TEST_true(BN_hex2bn(&b, "5AC635D8AA3A93E7B3EBBD55769886BC"
  361. "651D06B0CC53B0F63BCE3C3E27D2604B"))
  362. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  363. || !TEST_true(BN_hex2bn(&x, "6B17D1F2E12C4247F8BCE6E563A440F2"
  364. "77037D812DEB33A0F4A13945D898C296"))
  365. || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1,
  366. ctx))
  367. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  368. || !TEST_true(BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
  369. "BCE6FAADA7179E84F3B9CAC2FC632551"))
  370. || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
  371. || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
  372. goto err;
  373. TEST_info("NIST curve P-256 -- Generator");
  374. test_output_bignum("x", x);
  375. test_output_bignum("y", y);
  376. /* G_y value taken from the standard: */
  377. if (!TEST_true(BN_hex2bn(&z, "4FE342E2FE1A7F9B8EE7EB4A7C0F9E16"
  378. "2BCE33576B315ECECBB6406837BF51F5"))
  379. || !TEST_BN_eq(y, z)
  380. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  381. /*
  382. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  383. * and therefore setting the coordinates should fail.
  384. */
  385. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
  386. yplusone, ctx))
  387. || !TEST_int_eq(EC_GROUP_get_degree(group), 256)
  388. || !group_order_tests(group)
  389. || !TEST_ptr(P_256 = EC_GROUP_new(EC_GROUP_method_of(group)))
  390. || !TEST_true(EC_GROUP_copy(P_256, group))
  391. /* Curve P-384 (FIPS PUB 186-2, App. 6) */
  392. || !TEST_true(BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  393. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
  394. "FFFFFFFF0000000000000000FFFFFFFF"))
  395. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  396. || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  397. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
  398. "FFFFFFFF0000000000000000FFFFFFFC"))
  399. || !TEST_true(BN_hex2bn(&b, "B3312FA7E23EE7E4988E056BE3F82D19"
  400. "181D9C6EFE8141120314088F5013875A"
  401. "C656398D8A2ED19D2A85C8EDD3EC2AEF"))
  402. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  403. || !TEST_true(BN_hex2bn(&x, "AA87CA22BE8B05378EB1C71EF320AD74"
  404. "6E1D3B628BA79B9859F741E082542A38"
  405. "5502F25DBF55296C3A545E3872760AB7"))
  406. || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1,
  407. ctx))
  408. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  409. || !TEST_true(BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  410. "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
  411. "581A0DB248B0A77AECEC196ACCC52973"))
  412. || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
  413. || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
  414. goto err;
  415. TEST_info("NIST curve P-384 -- Generator");
  416. test_output_bignum("x", x);
  417. test_output_bignum("y", y);
  418. /* G_y value taken from the standard: */
  419. if (!TEST_true(BN_hex2bn(&z, "3617DE4A96262C6F5D9E98BF9292DC29"
  420. "F8F41DBD289A147CE9DA3113B5F0B8C0"
  421. "0A60B1CE1D7E819D7A431D7C90EA0E5F"))
  422. || !TEST_BN_eq(y, z)
  423. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  424. /*
  425. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  426. * and therefore setting the coordinates should fail.
  427. */
  428. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
  429. yplusone, ctx))
  430. || !TEST_int_eq(EC_GROUP_get_degree(group), 384)
  431. || !group_order_tests(group)
  432. || !TEST_ptr(P_384 = EC_GROUP_new(EC_GROUP_method_of(group)))
  433. || !TEST_true(EC_GROUP_copy(P_384, group))
  434. /* Curve P-521 (FIPS PUB 186-2, App. 6) */
  435. || !TEST_true(BN_hex2bn(&p, "1FF"
  436. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  437. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  438. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  439. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"))
  440. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  441. || !TEST_true(BN_hex2bn(&a, "1FF"
  442. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  443. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  444. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  445. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC"))
  446. || !TEST_true(BN_hex2bn(&b, "051"
  447. "953EB9618E1C9A1F929A21A0B68540EE"
  448. "A2DA725B99B315F3B8B489918EF109E1"
  449. "56193951EC7E937B1652C0BD3BB1BF07"
  450. "3573DF883D2C34F1EF451FD46B503F00"))
  451. || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
  452. || !TEST_true(BN_hex2bn(&x, "C6"
  453. "858E06B70404E9CD9E3ECB662395B442"
  454. "9C648139053FB521F828AF606B4D3DBA"
  455. "A14B5E77EFE75928FE1DC127A2FFA8DE"
  456. "3348B3C1856A429BF97E7E31C2E5BD66"))
  457. || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0,
  458. ctx))
  459. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  460. || !TEST_true(BN_hex2bn(&z, "1FF"
  461. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  462. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA"
  463. "51868783BF2F966B7FCC0148F709A5D0"
  464. "3BB5C9B8899C47AEBB6FB71E91386409"))
  465. || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
  466. || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
  467. goto err;
  468. TEST_info("NIST curve P-521 -- Generator");
  469. test_output_bignum("x", x);
  470. test_output_bignum("y", y);
  471. /* G_y value taken from the standard: */
  472. if (!TEST_true(BN_hex2bn(&z, "118"
  473. "39296A789A3BC0045C8A5FB42C7D1BD9"
  474. "98F54449579B446817AFBD17273E662C"
  475. "97EE72995EF42640C550B9013FAD0761"
  476. "353C7086A272C24088BE94769FD16650"))
  477. || !TEST_BN_eq(y, z)
  478. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  479. /*
  480. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  481. * and therefore setting the coordinates should fail.
  482. */
  483. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
  484. yplusone, ctx))
  485. || !TEST_int_eq(EC_GROUP_get_degree(group), 521)
  486. || !group_order_tests(group)
  487. || !TEST_ptr(P_521 = EC_GROUP_new(EC_GROUP_method_of(group)))
  488. || !TEST_true(EC_GROUP_copy(P_521, group))
  489. /* more tests using the last curve */
  490. /* Restore the point that got mangled in the (x, y + 1) test. */
  491. || !TEST_true(EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
  492. || !TEST_true(EC_POINT_copy(Q, P))
  493. || !TEST_false(EC_POINT_is_at_infinity(group, Q))
  494. || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
  495. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  496. || !TEST_true(EC_POINT_invert(group, Q, ctx)) /* P = -2Q */
  497. || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
  498. || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
  499. || !TEST_true(EC_POINT_is_at_infinity(group, R)) /* R = P + 2Q */
  500. || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
  501. goto err;
  502. points[0] = Q;
  503. points[1] = Q;
  504. points[2] = Q;
  505. points[3] = Q;
  506. if (!TEST_true(EC_GROUP_get_order(group, z, ctx))
  507. || !TEST_true(BN_add(y, z, BN_value_one()))
  508. || !TEST_BN_even(y)
  509. || !TEST_true(BN_rshift1(y, y)))
  510. goto err;
  511. scalars[0] = y; /* (group order + 1)/2, so y*Q + y*Q = Q */
  512. scalars[1] = y;
  513. TEST_note("combined multiplication ...");
  514. /* z is still the group order */
  515. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
  516. || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
  517. || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
  518. || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx))
  519. || !TEST_true(BN_rand(y, BN_num_bits(y), 0, 0))
  520. || !TEST_true(BN_add(z, z, y)))
  521. goto err;
  522. BN_set_negative(z, 1);
  523. scalars[0] = y;
  524. scalars[1] = z; /* z = -(order + y) */
  525. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
  526. || !TEST_true(EC_POINT_is_at_infinity(group, P))
  527. || !TEST_true(BN_rand(x, BN_num_bits(y) - 1, 0, 0))
  528. || !TEST_true(BN_add(z, x, y)))
  529. goto err;
  530. BN_set_negative(z, 1);
  531. scalars[0] = x;
  532. scalars[1] = y;
  533. scalars[2] = z; /* z = -(x+y) */
  534. if (!TEST_ptr(scalar3 = BN_new()))
  535. goto err;
  536. BN_zero(scalar3);
  537. scalars[3] = scalar3;
  538. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 4, points, scalars, ctx))
  539. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  540. goto err;
  541. TEST_note(" ok\n");
  542. r = 1;
  543. err:
  544. BN_CTX_free(ctx);
  545. BN_free(p);
  546. BN_free(a);
  547. BN_free(b);
  548. EC_GROUP_free(group);
  549. EC_GROUP_free(tmp);
  550. EC_POINT_free(P);
  551. EC_POINT_free(Q);
  552. EC_POINT_free(R);
  553. BN_free(x);
  554. BN_free(y);
  555. BN_free(z);
  556. BN_free(yplusone);
  557. BN_free(scalar3);
  558. EC_GROUP_free(P_160);
  559. EC_GROUP_free(P_192);
  560. EC_GROUP_free(P_224);
  561. EC_GROUP_free(P_256);
  562. EC_GROUP_free(P_384);
  563. EC_GROUP_free(P_521);
  564. return r;
  565. }
  566. # ifndef OPENSSL_NO_EC2M
  567. static struct c2_curve_test {
  568. const char *name;
  569. const char *p;
  570. const char *a;
  571. const char *b;
  572. const char *x;
  573. const char *y;
  574. int ybit;
  575. const char *order;
  576. const char *cof;
  577. int degree;
  578. } char2_curve_tests[] = {
  579. /* Curve K-163 (FIPS PUB 186-2, App. 6) */
  580. {
  581. "NIST curve K-163",
  582. "0800000000000000000000000000000000000000C9",
  583. "1",
  584. "1",
  585. "02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8",
  586. "0289070FB05D38FF58321F2E800536D538CCDAA3D9",
  587. 1, "04000000000000000000020108A2E0CC0D99F8A5EF", "2", 163
  588. },
  589. /* Curve B-163 (FIPS PUB 186-2, App. 6) */
  590. {
  591. "NIST curve B-163",
  592. "0800000000000000000000000000000000000000C9",
  593. "1",
  594. "020A601907B8C953CA1481EB10512F78744A3205FD",
  595. "03F0EBA16286A2D57EA0991168D4994637E8343E36",
  596. "00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
  597. 1, "040000000000000000000292FE77E70C12A4234C33", "2", 163
  598. },
  599. /* Curve K-233 (FIPS PUB 186-2, App. 6) */
  600. {
  601. "NIST curve K-233",
  602. "020000000000000000000000000000000000000004000000000000000001",
  603. "0",
  604. "1",
  605. "017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126",
  606. "01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
  607. 0,
  608. "008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF",
  609. "4", 233
  610. },
  611. /* Curve B-233 (FIPS PUB 186-2, App. 6) */
  612. {
  613. "NIST curve B-233",
  614. "020000000000000000000000000000000000000004000000000000000001",
  615. "000000000000000000000000000000000000000000000000000000000001",
  616. "0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
  617. "00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B",
  618. "01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
  619. 1,
  620. "01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7",
  621. "2", 233
  622. },
  623. /* Curve K-283 (FIPS PUB 186-2, App. 6) */
  624. {
  625. "NIST curve K-283",
  626. "08000000"
  627. "00000000000000000000000000000000000000000000000000000000000010A1",
  628. "0",
  629. "1",
  630. "0503213F"
  631. "78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836",
  632. "01CCDA38"
  633. "0F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259",
  634. 0,
  635. "01FFFFFF"
  636. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61",
  637. "4", 283
  638. },
  639. /* Curve B-283 (FIPS PUB 186-2, App. 6) */
  640. {
  641. "NIST curve B-283",
  642. "08000000"
  643. "00000000000000000000000000000000000000000000000000000000000010A1",
  644. "00000000"
  645. "0000000000000000000000000000000000000000000000000000000000000001",
  646. "027B680A"
  647. "C8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5",
  648. "05F93925"
  649. "8DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053",
  650. "03676854"
  651. "FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4",
  652. 1,
  653. "03FFFFFF"
  654. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307",
  655. "2", 283
  656. },
  657. /* Curve K-409 (FIPS PUB 186-2, App. 6) */
  658. {
  659. "NIST curve K-409",
  660. "0200000000000000000000000000000000000000"
  661. "0000000000000000000000000000000000000000008000000000000000000001",
  662. "0",
  663. "1",
  664. "0060F05F658F49C1AD3AB1890F7184210EFD0987"
  665. "E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746",
  666. "01E369050B7C4E42ACBA1DACBF04299C3460782F"
  667. "918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B",
  668. 1,
  669. "007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  670. "FFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF",
  671. "4", 409
  672. },
  673. /* Curve B-409 (FIPS PUB 186-2, App. 6) */
  674. {
  675. "NIST curve B-409",
  676. "0200000000000000000000000000000000000000"
  677. "0000000000000000000000000000000000000000008000000000000000000001",
  678. "0000000000000000000000000000000000000000"
  679. "0000000000000000000000000000000000000000000000000000000000000001",
  680. "0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422E"
  681. "F1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F",
  682. "015D4860D088DDB3496B0C6064756260441CDE4A"
  683. "F1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7",
  684. "0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5"
  685. "A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706",
  686. 1,
  687. "0100000000000000000000000000000000000000"
  688. "00000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173",
  689. "2", 409
  690. },
  691. /* Curve K-571 (FIPS PUB 186-2, App. 6) */
  692. {
  693. "NIST curve K-571",
  694. "800000000000000"
  695. "0000000000000000000000000000000000000000000000000000000000000000"
  696. "0000000000000000000000000000000000000000000000000000000000000425",
  697. "0",
  698. "1",
  699. "026EB7A859923FBC"
  700. "82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E6"
  701. "47DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972",
  702. "0349DC807F4FBF37"
  703. "4F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA7"
  704. "4FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3",
  705. 0,
  706. "0200000000000000"
  707. "00000000000000000000000000000000000000000000000000000000131850E1"
  708. "F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001",
  709. "4", 571
  710. },
  711. /* Curve B-571 (FIPS PUB 186-2, App. 6) */
  712. {
  713. "NIST curve B-571",
  714. "800000000000000"
  715. "0000000000000000000000000000000000000000000000000000000000000000"
  716. "0000000000000000000000000000000000000000000000000000000000000425",
  717. "0000000000000000"
  718. "0000000000000000000000000000000000000000000000000000000000000000"
  719. "0000000000000000000000000000000000000000000000000000000000000001",
  720. "02F40E7E2221F295"
  721. "DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA5933"
  722. "2BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A",
  723. "0303001D34B85629"
  724. "6C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293"
  725. "CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19",
  726. "037BF27342DA639B"
  727. "6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A57"
  728. "6291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B",
  729. 1,
  730. "03FFFFFFFFFFFFFF"
  731. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18"
  732. "FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47",
  733. "2", 571
  734. }
  735. };
  736. static int char2_curve_test(int n)
  737. {
  738. int r = 0;
  739. BN_CTX *ctx = NULL;
  740. BIGNUM *p = NULL, *a = NULL, *b = NULL;
  741. BIGNUM *x = NULL, *y = NULL, *z = NULL, *cof = NULL, *yplusone = NULL;
  742. EC_GROUP *group = NULL, *variable = NULL;
  743. EC_POINT *P = NULL, *Q = NULL, *R = NULL;
  744. const EC_POINT *points[3];
  745. const BIGNUM *scalars[3];
  746. struct c2_curve_test *const test = char2_curve_tests + n;
  747. if (!TEST_ptr(ctx = BN_CTX_new())
  748. || !TEST_ptr(p = BN_new())
  749. || !TEST_ptr(a = BN_new())
  750. || !TEST_ptr(b = BN_new())
  751. || !TEST_ptr(x = BN_new())
  752. || !TEST_ptr(y = BN_new())
  753. || !TEST_ptr(z = BN_new())
  754. || !TEST_ptr(yplusone = BN_new())
  755. || !TEST_true(BN_hex2bn(&p, test->p))
  756. || !TEST_true(BN_hex2bn(&a, test->a))
  757. || !TEST_true(BN_hex2bn(&b, test->b))
  758. || !TEST_true(group = EC_GROUP_new(EC_GF2m_simple_method()))
  759. || !TEST_true(EC_GROUP_set_curve_GF2m(group, p, a, b, ctx))
  760. || !TEST_ptr(P = EC_POINT_new(group))
  761. || !TEST_ptr(Q = EC_POINT_new(group))
  762. || !TEST_ptr(R = EC_POINT_new(group))
  763. || !TEST_true(BN_hex2bn(&x, test->x))
  764. || !TEST_true(BN_hex2bn(&y, test->y))
  765. || !TEST_true(BN_add(yplusone, y, BN_value_one())))
  766. goto err;
  767. /* Change test based on whether binary point compression is enabled or not. */
  768. # ifdef OPENSSL_EC_BIN_PT_COMP
  769. /*
  770. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  771. * and therefore setting the coordinates should fail.
  772. */
  773. if (!TEST_false(EC_POINT_set_affine_coordinates_GF2m(group, P, x, yplusone,
  774. ctx))
  775. || !TEST_true(EC_POINT_set_compressed_coordinates_GF2m(group, P, x,
  776. test->y_bit,
  777. ctx))
  778. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  779. || !TEST_true(BN_hex2bn(&z, test->order))
  780. || !TEST_true(BN_hex2bn(&cof, test->cof))
  781. || !TEST_true(EC_GROUP_set_generator(group, P, z, cof))
  782. || !TEST_true(EC_POINT_get_affine_coordinates_GF2m(group, P, x, y,
  783. ctx)))
  784. goto err;
  785. TEST_info("%s -- Generator", test->name);
  786. test_output_bignum("x", x);
  787. test_output_bignum("y", y);
  788. /* G_y value taken from the standard: */
  789. if (!TEST_true(BN_hex2bn(&z, test->y))
  790. || !TEST_BN_eq(y, z))
  791. goto err;
  792. # else
  793. /*
  794. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  795. * and therefore setting the coordinates should fail.
  796. */
  797. if (!TEST_false(EC_POINT_set_affine_coordinates_GF2m(group, P, x, yplusone,
  798. ctx))
  799. || !TEST_true(EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx))
  800. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  801. || !TEST_true(BN_hex2bn(&z, test->order))
  802. || !TEST_true(BN_hex2bn(&cof, test->cof))
  803. || !TEST_true(EC_GROUP_set_generator(group, P, z, cof)))
  804. goto err;
  805. TEST_info("%s -- Generator:", test->name);
  806. test_output_bignum("x", x);
  807. test_output_bignum("y", y);
  808. # endif
  809. if (!TEST_int_eq(EC_GROUP_get_degree(group), test->degree)
  810. || !group_order_tests(group)
  811. || !TEST_ptr(variable = EC_GROUP_new(EC_GROUP_method_of(group)))
  812. || !TEST_true(EC_GROUP_copy(variable, group)))
  813. goto err;
  814. /* more tests using the last curve */
  815. if (n == OSSL_NELEM(char2_curve_tests) - 1) {
  816. if (!TEST_true(EC_POINT_set_affine_coordinates_GF2m(group, P, x, y,
  817. ctx))
  818. || !TEST_true(EC_POINT_copy(Q, P))
  819. || !TEST_false(EC_POINT_is_at_infinity(group, Q))
  820. || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
  821. || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
  822. || !TEST_true(EC_POINT_invert(group, Q, ctx)) /* P = -2Q */
  823. || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
  824. || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
  825. || !TEST_true(EC_POINT_is_at_infinity(group, R)) /* R = P + 2Q */
  826. || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
  827. goto err;
  828. points[0] = Q;
  829. points[1] = Q;
  830. points[2] = Q;
  831. if (!TEST_true(BN_add(y, z, BN_value_one()))
  832. || !TEST_BN_even(y)
  833. || !TEST_true(BN_rshift1(y, y)))
  834. goto err;
  835. scalars[0] = y; /* (group order + 1)/2, so y*Q + y*Q = Q */
  836. scalars[1] = y;
  837. TEST_note("combined multiplication ...");
  838. /* z is still the group order */
  839. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
  840. || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
  841. || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
  842. || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx)))
  843. goto err;
  844. if (!TEST_true(BN_rand(y, BN_num_bits(y), 0, 0))
  845. || !TEST_true(BN_add(z, z, y)))
  846. goto err;
  847. BN_set_negative(z, 1);
  848. scalars[0] = y;
  849. scalars[1] = z; /* z = -(order + y) */
  850. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
  851. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  852. goto err;
  853. if (!TEST_true(BN_rand(x, BN_num_bits(y) - 1, 0, 0))
  854. || !TEST_true(BN_add(z, x, y)))
  855. goto err;
  856. BN_set_negative(z, 1);
  857. scalars[0] = x;
  858. scalars[1] = y;
  859. scalars[2] = z; /* z = -(x+y) */
  860. if (!TEST_true(EC_POINTs_mul(group, P, NULL, 3, points, scalars, ctx))
  861. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  862. goto err;;
  863. }
  864. r = 1;
  865. err:
  866. BN_CTX_free(ctx);
  867. BN_free(p);
  868. BN_free(a);
  869. BN_free(b);
  870. BN_free(x);
  871. BN_free(y);
  872. BN_free(z);
  873. BN_free(yplusone);
  874. BN_free(cof);
  875. EC_POINT_free(P);
  876. EC_POINT_free(Q);
  877. EC_POINT_free(R);
  878. EC_GROUP_free(group);
  879. EC_GROUP_free(variable);
  880. return r;
  881. }
  882. static int char2_field_tests(void)
  883. {
  884. BN_CTX *ctx = NULL;
  885. BIGNUM *p = NULL, *a = NULL, *b = NULL;
  886. EC_GROUP *group = NULL, *tmp = NULL;
  887. EC_POINT *P = NULL, *Q = NULL, *R = NULL;
  888. BIGNUM *x = NULL, *y = NULL, *z = NULL, *cof = NULL, *yplusone = NULL;
  889. unsigned char buf[100];
  890. size_t len;
  891. int k, r = 0;
  892. if (!TEST_ptr(ctx = BN_CTX_new())
  893. || !TEST_ptr(p = BN_new())
  894. || !TEST_ptr(a = BN_new())
  895. || !TEST_ptr(b = BN_new())
  896. || !TEST_true(BN_hex2bn(&p, "13"))
  897. || !TEST_true(BN_hex2bn(&a, "3"))
  898. || !TEST_true(BN_hex2bn(&b, "1")))
  899. goto err;
  900. group = EC_GROUP_new(EC_GF2m_simple_method()); /* applications should use
  901. * EC_GROUP_new_curve_GF2m
  902. * so that the library gets
  903. * to choose the EC_METHOD */
  904. if (!TEST_ptr(group)
  905. || !TEST_true(EC_GROUP_set_curve_GF2m(group, p, a, b, ctx))
  906. || !TEST_ptr(tmp = EC_GROUP_new(EC_GROUP_method_of(group)))
  907. || !TEST_true(EC_GROUP_copy(tmp, group)))
  908. goto err;
  909. EC_GROUP_free(group);
  910. group = tmp;
  911. tmp = NULL;
  912. if (!TEST_true(EC_GROUP_get_curve_GF2m(group, p, a, b, ctx)))
  913. goto err;
  914. TEST_info("Curve defined by Weierstrass equation");
  915. TEST_note(" y^2 + x*y = x^3 + a*x^2 + b (mod p)");
  916. test_output_bignum("a", a);
  917. test_output_bignum("b", b);
  918. test_output_bignum("p", p);
  919. if (!TEST_ptr(P = EC_POINT_new(group))
  920. || !TEST_ptr(Q = EC_POINT_new(group))
  921. || !TEST_ptr(R = EC_POINT_new(group))
  922. || !TEST_true(EC_POINT_set_to_infinity(group, P))
  923. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  924. goto err;
  925. buf[0] = 0;
  926. if (!TEST_true(EC_POINT_oct2point(group, Q, buf, 1, ctx))
  927. || !TEST_true(EC_POINT_add(group, P, P, Q, ctx))
  928. || !TEST_true(EC_POINT_is_at_infinity(group, P))
  929. || !TEST_ptr(x = BN_new())
  930. || !TEST_ptr(y = BN_new())
  931. || !TEST_ptr(z = BN_new())
  932. || !TEST_ptr(cof = BN_new())
  933. || !TEST_ptr(yplusone = BN_new())
  934. || !TEST_true(BN_hex2bn(&x, "6"))
  935. /* Change test based on whether binary point compression is enabled or not. */
  936. # ifdef OPENSSL_EC_BIN_PT_COMP
  937. || !TEST_true(EC_POINT_set_compressed_coordinates_GF2m(group, Q, x, 1,
  938. ctx))
  939. # else
  940. || !TEST_true(BN_hex2bn(&y, "8"))
  941. || !TEST_true(EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
  942. # endif
  943. )
  944. goto err;
  945. if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
  946. /* Change test based on whether binary point compression is enabled or not. */
  947. # ifdef OPENSSL_EC_BIN_PT_COMP
  948. if (!TEST_true(EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y,
  949. ctx)))
  950. goto err;
  951. # endif
  952. TEST_info("Point is not on curve");
  953. test_output_bignum("x", x);
  954. test_output_bignum("y", y);
  955. goto err;
  956. }
  957. TEST_note("A cyclic subgroup:");
  958. k = 100;
  959. do {
  960. if (!TEST_int_ne(k--, 0))
  961. goto err;
  962. if (EC_POINT_is_at_infinity(group, P))
  963. TEST_note(" point at infinity");
  964. else {
  965. if (!TEST_true(EC_POINT_get_affine_coordinates_GF2m(group, P, x, y,
  966. ctx)))
  967. goto err;
  968. test_output_bignum("x", x);
  969. test_output_bignum("y", y);
  970. }
  971. if (!TEST_true(EC_POINT_copy(R, P))
  972. || !TEST_true(EC_POINT_add(group, P, P, Q, ctx)))
  973. goto err;
  974. }
  975. while (!EC_POINT_is_at_infinity(group, P));
  976. if (!TEST_true(EC_POINT_add(group, P, Q, R, ctx))
  977. || !TEST_true(EC_POINT_is_at_infinity(group, P)))
  978. goto err;
  979. /* Change test based on whether binary point compression is enabled or not. */
  980. # ifdef OPENSSL_EC_BIN_PT_COMP
  981. len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED,
  982. buf, sizeof(buf), ctx);
  983. if (!TEST_size_t_ne(len, 0)
  984. || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
  985. || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
  986. goto err;
  987. test_output_memory("Generator as octet string, compressed form:",
  988. buf, len);
  989. # endif
  990. len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
  991. buf, sizeof(buf), ctx);
  992. if (!TEST_size_t_ne(len, 0)
  993. || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
  994. || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
  995. goto err;
  996. test_output_memory("Generator as octet string, uncompressed form:",
  997. buf, len);
  998. /* Change test based on whether binary point compression is enabled or not. */
  999. # ifdef OPENSSL_EC_BIN_PT_COMP
  1000. len =
  1001. EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof(buf),
  1002. ctx);
  1003. if (!TEST_size_t_ne(len, 0)
  1004. || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
  1005. || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
  1006. goto err;
  1007. test_output_memory("Generator as octet string, hybrid form:",
  1008. buf, len);
  1009. # endif
  1010. if (!TEST_true(EC_POINT_invert(group, P, ctx))
  1011. || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx)))
  1012. goto err;
  1013. TEST_note("\n");
  1014. r = 1;
  1015. err:
  1016. BN_CTX_free(ctx);
  1017. BN_free(p);
  1018. BN_free(a);
  1019. BN_free(b);
  1020. EC_GROUP_free(group);
  1021. EC_GROUP_free(tmp);
  1022. EC_POINT_free(P);
  1023. EC_POINT_free(Q);
  1024. EC_POINT_free(R);
  1025. BN_free(x);
  1026. BN_free(y);
  1027. BN_free(z);
  1028. BN_free(cof);
  1029. BN_free(yplusone);
  1030. return r;
  1031. }
  1032. # endif
  1033. static int internal_curve_test(int n)
  1034. {
  1035. EC_GROUP *group = NULL;
  1036. int nid = curves[n].nid;
  1037. if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
  1038. TEST_info("EC_GROUP_new_curve_name() failed with curve %s\n",
  1039. OBJ_nid2sn(nid));
  1040. return 0;
  1041. }
  1042. if (!TEST_true(EC_GROUP_check(group, NULL))) {
  1043. TEST_info("EC_GROUP_check() failed with curve %s\n", OBJ_nid2sn(nid));
  1044. EC_GROUP_free(group);
  1045. return 0;
  1046. }
  1047. EC_GROUP_free(group);
  1048. return 1;
  1049. }
  1050. static int internal_curve_test_method(int n)
  1051. {
  1052. int r, nid = curves[n].nid;
  1053. EC_GROUP *group;
  1054. if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
  1055. TEST_info("Curve %s failed\n", OBJ_nid2sn(nid));
  1056. return 0;
  1057. }
  1058. r = group_order_tests(group);
  1059. EC_GROUP_free(group);
  1060. return r;
  1061. }
  1062. # ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
  1063. /*
  1064. * nistp_test_params contains magic numbers for testing our optimized
  1065. * implementations of several NIST curves with characteristic > 3.
  1066. */
  1067. struct nistp_test_params {
  1068. const EC_METHOD *(*meth) ();
  1069. int degree;
  1070. /*
  1071. * Qx, Qy and D are taken from
  1072. * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
  1073. * Otherwise, values are standard curve parameters from FIPS 180-3
  1074. */
  1075. const char *p, *a, *b, *Qx, *Qy, *Gx, *Gy, *order, *d;
  1076. };
  1077. static const struct nistp_test_params nistp_tests_params[] = {
  1078. {
  1079. /* P-224 */
  1080. EC_GFp_nistp224_method,
  1081. 224,
  1082. /* p */
  1083. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
  1084. /* a */
  1085. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
  1086. /* b */
  1087. "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
  1088. /* Qx */
  1089. "E84FB0B8E7000CB657D7973CF6B42ED78B301674276DF744AF130B3E",
  1090. /* Qy */
  1091. "4376675C6FC5612C21A0FF2D2A89D2987DF7A2BC52183B5982298555",
  1092. /* Gx */
  1093. "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
  1094. /* Gy */
  1095. "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
  1096. /* order */
  1097. "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
  1098. /* d */
  1099. "3F0C488E987C80BE0FEE521F8D90BE6034EC69AE11CA72AA777481E8",
  1100. },
  1101. {
  1102. /* P-256 */
  1103. EC_GFp_nistp256_method,
  1104. 256,
  1105. /* p */
  1106. "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
  1107. /* a */
  1108. "ffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
  1109. /* b */
  1110. "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
  1111. /* Qx */
  1112. "b7e08afdfe94bad3f1dc8c734798ba1c62b3a0ad1e9ea2a38201cd0889bc7a19",
  1113. /* Qy */
  1114. "3603f747959dbf7a4bb226e41928729063adc7ae43529e61b563bbc606cc5e09",
  1115. /* Gx */
  1116. "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
  1117. /* Gy */
  1118. "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
  1119. /* order */
  1120. "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
  1121. /* d */
  1122. "c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96",
  1123. },
  1124. {
  1125. /* P-521 */
  1126. EC_GFp_nistp521_method,
  1127. 521,
  1128. /* p */
  1129. "1ff"
  1130. "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  1131. "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
  1132. /* a */
  1133. "1ff"
  1134. "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  1135. "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
  1136. /* b */
  1137. "051"
  1138. "953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e1"
  1139. "56193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
  1140. /* Qx */
  1141. "0098"
  1142. "e91eef9a68452822309c52fab453f5f117c1da8ed796b255e9ab8f6410cca16e"
  1143. "59df403a6bdc6ca467a37056b1e54b3005d8ac030decfeb68df18b171885d5c4",
  1144. /* Qy */
  1145. "0164"
  1146. "350c321aecfc1cca1ba4364c9b15656150b4b78d6a48d7d28e7f31985ef17be8"
  1147. "554376b72900712c4b83ad668327231526e313f5f092999a4632fd50d946bc2e",
  1148. /* Gx */
  1149. "c6"
  1150. "858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dba"
  1151. "a14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
  1152. /* Gy */
  1153. "118"
  1154. "39296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c"
  1155. "97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
  1156. /* order */
  1157. "1ff"
  1158. "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa"
  1159. "51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
  1160. /* d */
  1161. "0100"
  1162. "085f47b8e1b8b11b7eb33028c0b2888e304bfc98501955b45bba1478dc184eee"
  1163. "df09b86a5f7c21994406072787205e69a63709fe35aa93ba333514b24f961722",
  1164. },
  1165. };
  1166. static int nistp_single_test(int idx)
  1167. {
  1168. const struct nistp_test_params *test = nistp_tests_params + idx;
  1169. BN_CTX *ctx = NULL;
  1170. BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL;
  1171. BIGNUM *n = NULL, *m = NULL, *order = NULL, *yplusone = NULL;
  1172. EC_GROUP *NISTP = NULL;
  1173. EC_POINT *G = NULL, *P = NULL, *Q = NULL, *Q_CHECK = NULL;
  1174. int r = 0;
  1175. TEST_note("NIST curve P-%d (optimised implementation):",
  1176. test->degree);
  1177. if (!TEST_ptr(ctx = BN_CTX_new())
  1178. || !TEST_ptr(p = BN_new())
  1179. || !TEST_ptr(a = BN_new())
  1180. || !TEST_ptr(b = BN_new())
  1181. || !TEST_ptr(x = BN_new())
  1182. || !TEST_ptr(y = BN_new())
  1183. || !TEST_ptr(m = BN_new())
  1184. || !TEST_ptr(n = BN_new())
  1185. || !TEST_ptr(order = BN_new())
  1186. || !TEST_ptr(yplusone = BN_new())
  1187. || !TEST_ptr(NISTP = EC_GROUP_new(test->meth()))
  1188. || !TEST_true(BN_hex2bn(&p, test->p))
  1189. || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
  1190. || !TEST_true(BN_hex2bn(&a, test->a))
  1191. || !TEST_true(BN_hex2bn(&b, test->b))
  1192. || !TEST_true(EC_GROUP_set_curve_GFp(NISTP, p, a, b, ctx))
  1193. || !TEST_ptr(G = EC_POINT_new(NISTP))
  1194. || !TEST_ptr(P = EC_POINT_new(NISTP))
  1195. || !TEST_ptr(Q = EC_POINT_new(NISTP))
  1196. || !TEST_ptr(Q_CHECK = EC_POINT_new(NISTP))
  1197. || !TEST_true(BN_hex2bn(&x, test->Qx))
  1198. || !TEST_true(BN_hex2bn(&y, test->Qy))
  1199. || !TEST_true(BN_add(yplusone, y, BN_value_one()))
  1200. /*
  1201. * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
  1202. * and therefore setting the coordinates should fail.
  1203. */
  1204. || !TEST_false(EC_POINT_set_affine_coordinates_GFp(NISTP, Q_CHECK, x,
  1205. yplusone, ctx))
  1206. || !TEST_true(EC_POINT_set_affine_coordinates_GFp(NISTP, Q_CHECK, x, y,
  1207. ctx))
  1208. || !TEST_true(BN_hex2bn(&x, test->Gx))
  1209. || !TEST_true(BN_hex2bn(&y, test->Gy))
  1210. || !TEST_true(EC_POINT_set_affine_coordinates_GFp(NISTP, G, x, y, ctx))
  1211. || !TEST_true(BN_hex2bn(&order, test->order))
  1212. || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one()))
  1213. || !TEST_int_eq(EC_GROUP_get_degree(NISTP), test->degree))
  1214. goto err;
  1215. TEST_note("NIST test vectors ... ");
  1216. if (!TEST_true(BN_hex2bn(&n, test->d)))
  1217. goto err;
  1218. /* fixed point multiplication */
  1219. EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
  1220. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
  1221. goto err;
  1222. /* random point multiplication */
  1223. EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
  1224. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
  1225. /* set generator to P = 2*G, where G is the standard generator */
  1226. || !TEST_true(EC_POINT_dbl(NISTP, P, G, ctx))
  1227. || !TEST_true(EC_GROUP_set_generator(NISTP, P, order, BN_value_one()))
  1228. /* set the scalar to m=n/2, where n is the NIST test scalar */
  1229. || !TEST_true(BN_rshift(m, n, 1)))
  1230. goto err;
  1231. /* test the non-standard generator */
  1232. /* fixed point multiplication */
  1233. EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
  1234. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
  1235. goto err;
  1236. /* random point multiplication */
  1237. EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
  1238. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
  1239. /*
  1240. * We have not performed precomputation so have_precompute mult should be
  1241. * false
  1242. */
  1243. || !TEST_false(EC_GROUP_have_precompute_mult(NISTP))
  1244. /* now repeat all tests with precomputation */
  1245. || !TEST_true(EC_GROUP_precompute_mult(NISTP, ctx))
  1246. || !TEST_true(EC_GROUP_have_precompute_mult(NISTP)))
  1247. goto err;
  1248. /* fixed point multiplication */
  1249. EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
  1250. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
  1251. goto err;
  1252. /* random point multiplication */
  1253. EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
  1254. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
  1255. /* reset generator */
  1256. || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one())))
  1257. goto err;
  1258. /* fixed point multiplication */
  1259. EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
  1260. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
  1261. goto err;
  1262. /* random point multiplication */
  1263. EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
  1264. if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
  1265. goto err;
  1266. /* regression test for felem_neg bug */
  1267. if (!TEST_true(BN_set_word(m, 32))
  1268. || !TEST_true(BN_set_word(n, 31))
  1269. || !TEST_true(EC_POINT_copy(P, G))
  1270. || !TEST_true(EC_POINT_invert(NISTP, P, ctx))
  1271. || !TEST_true(EC_POINT_mul(NISTP, Q, m, P, n, ctx))
  1272. || !TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, G, ctx)))
  1273. goto err;
  1274. r = group_order_tests(NISTP);
  1275. err:
  1276. EC_GROUP_free(NISTP);
  1277. EC_POINT_free(G);
  1278. EC_POINT_free(P);
  1279. EC_POINT_free(Q);
  1280. EC_POINT_free(Q_CHECK);
  1281. BN_free(n);
  1282. BN_free(m);
  1283. BN_free(p);
  1284. BN_free(a);
  1285. BN_free(b);
  1286. BN_free(x);
  1287. BN_free(y);
  1288. BN_free(order);
  1289. BN_free(yplusone);
  1290. BN_CTX_free(ctx);
  1291. return r;
  1292. }
  1293. # endif
  1294. static int parameter_test(void)
  1295. {
  1296. EC_GROUP *group = NULL, *group2 = NULL;
  1297. ECPARAMETERS *ecparameters = NULL;
  1298. int r;
  1299. r = TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_secp112r1))
  1300. && TEST_ptr(ecparameters = EC_GROUP_get_ecparameters(group, NULL))
  1301. && TEST_ptr(group2 = EC_GROUP_new_from_ecparameters(ecparameters))
  1302. && TEST_int_eq(EC_GROUP_cmp(group, group2, NULL), 0);
  1303. EC_GROUP_free(group);
  1304. EC_GROUP_free(group2);
  1305. ECPARAMETERS_free(ecparameters);
  1306. return r;
  1307. }
  1308. #endif
  1309. int setup_tests(void)
  1310. {
  1311. #ifndef OPENSSL_NO_EC
  1312. crv_len = EC_get_builtin_curves(NULL, 0);
  1313. if (!TEST_ptr(curves = OPENSSL_malloc(sizeof(*curves) * crv_len))
  1314. || !TEST_true(EC_get_builtin_curves(curves, crv_len)))
  1315. return 0;
  1316. ADD_TEST(parameter_test);
  1317. ADD_TEST(prime_field_tests);
  1318. # ifndef OPENSSL_NO_EC2M
  1319. ADD_TEST(char2_field_tests);
  1320. ADD_ALL_TESTS(char2_curve_test, OSSL_NELEM(char2_curve_tests));
  1321. # endif
  1322. # ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
  1323. ADD_ALL_TESTS(nistp_single_test, OSSL_NELEM(nistp_tests_params));
  1324. # endif
  1325. ADD_ALL_TESTS(internal_curve_test, crv_len);
  1326. ADD_ALL_TESTS(internal_curve_test_method, crv_len);
  1327. #endif
  1328. return 1;
  1329. }
  1330. void cleanup_tests(void)
  1331. {
  1332. #ifndef OPENSSL_NO_EC
  1333. OPENSSL_free(curves);
  1334. #endif
  1335. }