1*5697Smcpowers /*
2*5697Smcpowers * ***** BEGIN LICENSE BLOCK *****
3*5697Smcpowers * Version: MPL 1.1/GPL 2.0/LGPL 2.1
4*5697Smcpowers *
5*5697Smcpowers * The contents of this file are subject to the Mozilla Public License Version
6*5697Smcpowers * 1.1 (the "License"); you may not use this file except in compliance with
7*5697Smcpowers * the License. You may obtain a copy of the License at
8*5697Smcpowers * http://www.mozilla.org/MPL/
9*5697Smcpowers *
10*5697Smcpowers * Software distributed under the License is distributed on an "AS IS" basis,
11*5697Smcpowers * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
12*5697Smcpowers * for the specific language governing rights and limitations under the
13*5697Smcpowers * License.
14*5697Smcpowers *
15*5697Smcpowers * The Original Code is the elliptic curve math library for binary polynomial field curves.
16*5697Smcpowers *
17*5697Smcpowers * The Initial Developer of the Original Code is
18*5697Smcpowers * Sun Microsystems, Inc.
19*5697Smcpowers * Portions created by the Initial Developer are Copyright (C) 2003
20*5697Smcpowers * the Initial Developer. All Rights Reserved.
21*5697Smcpowers *
22*5697Smcpowers * Contributor(s):
23*5697Smcpowers * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories
24*5697Smcpowers *
25*5697Smcpowers * Alternatively, the contents of this file may be used under the terms of
26*5697Smcpowers * either the GNU General Public License Version 2 or later (the "GPL"), or
27*5697Smcpowers * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
28*5697Smcpowers * in which case the provisions of the GPL or the LGPL are applicable instead
29*5697Smcpowers * of those above. If you wish to allow use of your version of this file only
30*5697Smcpowers * under the terms of either the GPL or the LGPL, and not to allow others to
31*5697Smcpowers * use your version of this file under the terms of the MPL, indicate your
32*5697Smcpowers * decision by deleting the provisions above and replace them with the notice
33*5697Smcpowers * and other provisions required by the GPL or the LGPL. If you do not delete
34*5697Smcpowers * the provisions above, a recipient may use your version of this file under
35*5697Smcpowers * the terms of any one of the MPL, the GPL or the LGPL.
36*5697Smcpowers *
37*5697Smcpowers * ***** END LICENSE BLOCK ***** */
38*5697Smcpowers /*
39*5697Smcpowers * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
40*5697Smcpowers * Use is subject to license terms.
41*5697Smcpowers *
42*5697Smcpowers * Sun elects to use this software under the MPL license.
43*5697Smcpowers */
44*5697Smcpowers
45*5697Smcpowers #pragma ident "%Z%%M% %I% %E% SMI"
46*5697Smcpowers
47*5697Smcpowers #ifdef _KERNEL
48*5697Smcpowers #include <sys/types.h>
49*5697Smcpowers #include <sys/systm.h>
50*5697Smcpowers #include <sys/param.h>
51*5697Smcpowers #include <sys/modctl.h>
52*5697Smcpowers #include <sys/ddi.h>
53*5697Smcpowers #include <sys/crypto/spi.h>
54*5697Smcpowers #include <sys/sysmacros.h>
55*5697Smcpowers #include <sys/strsun.h>
56*5697Smcpowers #include <sys/md5.h>
57*5697Smcpowers #include <sys/sha1.h>
58*5697Smcpowers #include <sys/sha2.h>
59*5697Smcpowers #include <sys/random.h>
60*5697Smcpowers #include <sys/conf.h>
61*5697Smcpowers #include <sys/devops.h>
62*5697Smcpowers #include <sys/sunddi.h>
63*5697Smcpowers #include <sys/varargs.h>
64*5697Smcpowers #include <sys/kmem.h>
65*5697Smcpowers #include <sys/kstat.h>
66*5697Smcpowers #include <sys/crypto/common.h>
67*5697Smcpowers #else
68*5697Smcpowers #include <stdio.h>
69*5697Smcpowers #include <string.h>
70*5697Smcpowers #include <strings.h>
71*5697Smcpowers #include <assert.h>
72*5697Smcpowers #include <time.h>
73*5697Smcpowers #include <sys/time.h>
74*5697Smcpowers #include <sys/resource.h>
75*5697Smcpowers #endif /* _KERNEL */
76*5697Smcpowers
77*5697Smcpowers #include "mpi.h"
78*5697Smcpowers #include "mplogic.h"
79*5697Smcpowers #include "mpprime.h"
80*5697Smcpowers #include "mp_gf2m.h"
81*5697Smcpowers #include "ecl.h"
82*5697Smcpowers #include "ecl-curve.h"
83*5697Smcpowers #include "ec2.h"
84*5697Smcpowers #include "ecc_impl.h"
85*5697Smcpowers #include "ec.h"
86*5697Smcpowers
87*5697Smcpowers #ifndef KM_SLEEP
88*5697Smcpowers #define KM_SLEEP 0
89*5697Smcpowers #endif
90*5697Smcpowers
91*5697Smcpowers #ifndef _KERNEL
92*5697Smcpowers /* Time k repetitions of operation op. */
93*5697Smcpowers #define M_TimeOperation(op, k) { \
94*5697Smcpowers double dStart, dNow, dUserTime; \
95*5697Smcpowers struct rusage ru; \
96*5697Smcpowers int i; \
97*5697Smcpowers getrusage(RUSAGE_SELF, &ru); \
98*5697Smcpowers dStart = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \
99*5697Smcpowers for (i = 0; i < k; i++) { \
100*5697Smcpowers { op; } \
101*5697Smcpowers }; \
102*5697Smcpowers getrusage(RUSAGE_SELF, &ru); \
103*5697Smcpowers dNow = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \
104*5697Smcpowers dUserTime = dNow-dStart; \
105*5697Smcpowers if (dUserTime) printf(" %-45s k: %6i, t: %6.2f sec\n", #op, k, dUserTime); \
106*5697Smcpowers }
107*5697Smcpowers #else
108*5697Smcpowers #define M_TimeOperation(op, k)
109*5697Smcpowers #endif
110*5697Smcpowers
111*5697Smcpowers /* Test curve using generic field arithmetic. */
112*5697Smcpowers #define ECTEST_GENERIC_GF2M(name_c, name) \
113*5697Smcpowers printf("Testing %s using generic implementation...\n", name_c); \
114*5697Smcpowers params = EC_GetNamedCurveParams(name, KM_SLEEP); \
115*5697Smcpowers if (params == NULL) { \
116*5697Smcpowers printf(" Error: could not construct params.\n"); \
117*5697Smcpowers res = MP_NO; \
118*5697Smcpowers goto CLEANUP; \
119*5697Smcpowers } \
120*5697Smcpowers ECGroup_free(group); \
121*5697Smcpowers group = ECGroup_fromHex(params, KM_SLEEP); \
122*5697Smcpowers if (group == NULL) { \
123*5697Smcpowers printf(" Error: could not construct group.\n"); \
124*5697Smcpowers res = MP_NO; \
125*5697Smcpowers goto CLEANUP; \
126*5697Smcpowers } \
127*5697Smcpowers MP_CHECKOK( ectest_curve_GF2m(group, ectestPrint, ectestTime, 1, KM_SLEEP) ); \
128*5697Smcpowers printf("... okay.\n");
129*5697Smcpowers
130*5697Smcpowers /* Test curve using specific field arithmetic. */
131*5697Smcpowers #define ECTEST_NAMED_GF2M(name_c, name) \
132*5697Smcpowers printf("Testing %s using specific implementation...\n", name_c); \
133*5697Smcpowers ECGroup_free(group); \
134*5697Smcpowers group = ECGroup_fromName(name, KM_SLEEP); \
135*5697Smcpowers if (group == NULL) { \
136*5697Smcpowers printf(" Warning: could not construct group.\n"); \
137*5697Smcpowers printf("... failed; continuing with remaining tests.\n"); \
138*5697Smcpowers } else { \
139*5697Smcpowers MP_CHECKOK( ectest_curve_GF2m(group, ectestPrint, ectestTime, 0, KM_SLEEP) ); \
140*5697Smcpowers printf("... okay.\n"); \
141*5697Smcpowers }
142*5697Smcpowers
143*5697Smcpowers /* Performs basic tests of elliptic curve cryptography over binary
144*5697Smcpowers * polynomial fields. If tests fail, then it prints an error message,
145*5697Smcpowers * aborts, and returns an error code. Otherwise, returns 0. */
146*5697Smcpowers int
ectest_curve_GF2m(ECGroup * group,int ectestPrint,int ectestTime,int generic,int kmflag)147*5697Smcpowers ectest_curve_GF2m(ECGroup *group, int ectestPrint, int ectestTime,
148*5697Smcpowers int generic, int kmflag)
149*5697Smcpowers {
150*5697Smcpowers
151*5697Smcpowers mp_int one, order_1, gx, gy, rx, ry, n;
152*5697Smcpowers int size;
153*5697Smcpowers mp_err res;
154*5697Smcpowers char s[1000];
155*5697Smcpowers
156*5697Smcpowers /* initialize values */
157*5697Smcpowers MP_CHECKOK(mp_init(&one, kmflag));
158*5697Smcpowers MP_CHECKOK(mp_init(&order_1, kmflag));
159*5697Smcpowers MP_CHECKOK(mp_init(&gx, kmflag));
160*5697Smcpowers MP_CHECKOK(mp_init(&gy, kmflag));
161*5697Smcpowers MP_CHECKOK(mp_init(&rx, kmflag));
162*5697Smcpowers MP_CHECKOK(mp_init(&ry, kmflag));
163*5697Smcpowers MP_CHECKOK(mp_init(&n, kmflag));
164*5697Smcpowers
165*5697Smcpowers MP_CHECKOK(mp_set_int(&one, 1));
166*5697Smcpowers MP_CHECKOK(mp_sub(&group->order, &one, &order_1));
167*5697Smcpowers
168*5697Smcpowers /* encode base point */
169*5697Smcpowers if (group->meth->field_dec) {
170*5697Smcpowers MP_CHECKOK(group->meth->field_dec(&group->genx, &gx, group->meth));
171*5697Smcpowers MP_CHECKOK(group->meth->field_dec(&group->geny, &gy, group->meth));
172*5697Smcpowers } else {
173*5697Smcpowers MP_CHECKOK(mp_copy(&group->genx, &gx));
174*5697Smcpowers MP_CHECKOK(mp_copy(&group->geny, &gy));
175*5697Smcpowers }
176*5697Smcpowers
177*5697Smcpowers if (ectestPrint) {
178*5697Smcpowers /* output base point */
179*5697Smcpowers printf(" base point P:\n");
180*5697Smcpowers MP_CHECKOK(mp_toradix(&gx, s, 16));
181*5697Smcpowers printf(" %s\n", s);
182*5697Smcpowers MP_CHECKOK(mp_toradix(&gy, s, 16));
183*5697Smcpowers printf(" %s\n", s);
184*5697Smcpowers if (group->meth->field_enc) {
185*5697Smcpowers printf(" base point P (encoded):\n");
186*5697Smcpowers MP_CHECKOK(mp_toradix(&group->genx, s, 16));
187*5697Smcpowers printf(" %s\n", s);
188*5697Smcpowers MP_CHECKOK(mp_toradix(&group->geny, s, 16));
189*5697Smcpowers printf(" %s\n", s);
190*5697Smcpowers }
191*5697Smcpowers }
192*5697Smcpowers
193*5697Smcpowers #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
194*5697Smcpowers /* multiply base point by order - 1 and check for negative of base
195*5697Smcpowers * point */
196*5697Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_aff
197*5697Smcpowers (&order_1, &group->genx, &group->geny, &rx, &ry, group));
198*5697Smcpowers if (ectestPrint) {
199*5697Smcpowers printf(" (order-1)*P (affine):\n");
200*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
201*5697Smcpowers printf(" %s\n", s);
202*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
203*5697Smcpowers printf(" %s\n", s);
204*5697Smcpowers }
205*5697Smcpowers MP_CHECKOK(group->meth->field_add(&ry, &rx, &ry, group->meth));
206*5697Smcpowers if ((mp_cmp(&rx, &group->genx) != 0)
207*5697Smcpowers || (mp_cmp(&ry, &group->geny) != 0)) {
208*5697Smcpowers printf(" Error: invalid result (expected (- base point)).\n");
209*5697Smcpowers res = MP_NO;
210*5697Smcpowers goto CLEANUP;
211*5697Smcpowers }
212*5697Smcpowers #endif
213*5697Smcpowers
214*5697Smcpowers /* multiply base point by order - 1 and check for negative of base
215*5697Smcpowers * point */
216*5697Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_mont
217*5697Smcpowers (&order_1, &group->genx, &group->geny, &rx, &ry, group));
218*5697Smcpowers if (ectestPrint) {
219*5697Smcpowers printf(" (order-1)*P (montgomery):\n");
220*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
221*5697Smcpowers printf(" %s\n", s);
222*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
223*5697Smcpowers printf(" %s\n", s);
224*5697Smcpowers }
225*5697Smcpowers MP_CHECKOK(group->meth->field_add(&ry, &rx, &ry, group->meth));
226*5697Smcpowers if ((mp_cmp(&rx, &group->genx) != 0)
227*5697Smcpowers || (mp_cmp(&ry, &group->geny) != 0)) {
228*5697Smcpowers printf(" Error: invalid result (expected (- base point)).\n");
229*5697Smcpowers res = MP_NO;
230*5697Smcpowers goto CLEANUP;
231*5697Smcpowers }
232*5697Smcpowers
233*5697Smcpowers #ifdef ECL_ENABLE_GF2M_PROJ
234*5697Smcpowers /* multiply base point by order - 1 and check for negative of base
235*5697Smcpowers * point */
236*5697Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_proj
237*5697Smcpowers (&order_1, &group->genx, &group->geny, &rx, &ry, group));
238*5697Smcpowers if (ectestPrint) {
239*5697Smcpowers printf(" (order-1)*P (projective):\n");
240*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
241*5697Smcpowers printf(" %s\n", s);
242*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
243*5697Smcpowers printf(" %s\n", s);
244*5697Smcpowers }
245*5697Smcpowers MP_CHECKOK(group->meth->field_add(&ry, &rx, &ry, group->meth));
246*5697Smcpowers if ((mp_cmp(&rx, &group->genx) != 0)
247*5697Smcpowers || (mp_cmp(&ry, &group->geny) != 0)) {
248*5697Smcpowers printf(" Error: invalid result (expected (- base point)).\n");
249*5697Smcpowers res = MP_NO;
250*5697Smcpowers goto CLEANUP;
251*5697Smcpowers }
252*5697Smcpowers #endif
253*5697Smcpowers
254*5697Smcpowers /* multiply base point by order - 1 and check for negative of base
255*5697Smcpowers * point */
256*5697Smcpowers MP_CHECKOK(ECPoint_mul(group, &order_1, NULL, NULL, &rx, &ry));
257*5697Smcpowers if (ectestPrint) {
258*5697Smcpowers printf(" (order-1)*P (ECPoint_mul):\n");
259*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
260*5697Smcpowers printf(" %s\n", s);
261*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
262*5697Smcpowers printf(" %s\n", s);
263*5697Smcpowers }
264*5697Smcpowers MP_CHECKOK(ec_GF2m_add(&ry, &rx, &ry, group->meth));
265*5697Smcpowers if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) {
266*5697Smcpowers printf(" Error: invalid result (expected (- base point)).\n");
267*5697Smcpowers res = MP_NO;
268*5697Smcpowers goto CLEANUP;
269*5697Smcpowers }
270*5697Smcpowers
271*5697Smcpowers /* multiply base point by order - 1 and check for negative of base
272*5697Smcpowers * point */
273*5697Smcpowers MP_CHECKOK(ECPoint_mul(group, &order_1, &gx, &gy, &rx, &ry));
274*5697Smcpowers if (ectestPrint) {
275*5697Smcpowers printf(" (order-1)*P (ECPoint_mul):\n");
276*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
277*5697Smcpowers printf(" %s\n", s);
278*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
279*5697Smcpowers printf(" %s\n", s);
280*5697Smcpowers }
281*5697Smcpowers MP_CHECKOK(ec_GF2m_add(&ry, &rx, &ry, group->meth));
282*5697Smcpowers if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) {
283*5697Smcpowers printf(" Error: invalid result (expected (- base point)).\n");
284*5697Smcpowers res = MP_NO;
285*5697Smcpowers goto CLEANUP;
286*5697Smcpowers }
287*5697Smcpowers
288*5697Smcpowers #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
289*5697Smcpowers /* multiply base point by order and check for point at infinity */
290*5697Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_aff
291*5697Smcpowers (&group->order, &group->genx, &group->geny, &rx, &ry,
292*5697Smcpowers group));
293*5697Smcpowers if (ectestPrint) {
294*5697Smcpowers printf(" (order)*P (affine):\n");
295*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
296*5697Smcpowers printf(" %s\n", s);
297*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
298*5697Smcpowers printf(" %s\n", s);
299*5697Smcpowers }
300*5697Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) {
301*5697Smcpowers printf(" Error: invalid result (expected point at infinity).\n");
302*5697Smcpowers res = MP_NO;
303*5697Smcpowers goto CLEANUP;
304*5697Smcpowers }
305*5697Smcpowers #endif
306*5697Smcpowers
307*5697Smcpowers /* multiply base point by order and check for point at infinity */
308*5697Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_mont
309*5697Smcpowers (&group->order, &group->genx, &group->geny, &rx, &ry,
310*5697Smcpowers group));
311*5697Smcpowers if (ectestPrint) {
312*5697Smcpowers printf(" (order)*P (montgomery):\n");
313*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
314*5697Smcpowers printf(" %s\n", s);
315*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
316*5697Smcpowers printf(" %s\n", s);
317*5697Smcpowers }
318*5697Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) {
319*5697Smcpowers printf(" Error: invalid result (expected point at infinity).\n");
320*5697Smcpowers res = MP_NO;
321*5697Smcpowers goto CLEANUP;
322*5697Smcpowers }
323*5697Smcpowers
324*5697Smcpowers #ifdef ECL_ENABLE_GF2M_PROJ
325*5697Smcpowers /* multiply base point by order and check for point at infinity */
326*5697Smcpowers MP_CHECKOK(ec_GF2m_pt_mul_proj
327*5697Smcpowers (&group->order, &group->genx, &group->geny, &rx, &ry,
328*5697Smcpowers group));
329*5697Smcpowers if (ectestPrint) {
330*5697Smcpowers printf(" (order)*P (projective):\n");
331*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
332*5697Smcpowers printf(" %s\n", s);
333*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
334*5697Smcpowers printf(" %s\n", s);
335*5697Smcpowers }
336*5697Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) {
337*5697Smcpowers printf(" Error: invalid result (expected point at infinity).\n");
338*5697Smcpowers res = MP_NO;
339*5697Smcpowers goto CLEANUP;
340*5697Smcpowers }
341*5697Smcpowers #endif
342*5697Smcpowers
343*5697Smcpowers /* multiply base point by order and check for point at infinity */
344*5697Smcpowers MP_CHECKOK(ECPoint_mul(group, &group->order, NULL, NULL, &rx, &ry));
345*5697Smcpowers if (ectestPrint) {
346*5697Smcpowers printf(" (order)*P (ECPoint_mul):\n");
347*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
348*5697Smcpowers printf(" %s\n", s);
349*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
350*5697Smcpowers printf(" %s\n", s);
351*5697Smcpowers }
352*5697Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) {
353*5697Smcpowers printf(" Error: invalid result (expected point at infinity).\n");
354*5697Smcpowers res = MP_NO;
355*5697Smcpowers goto CLEANUP;
356*5697Smcpowers }
357*5697Smcpowers
358*5697Smcpowers /* multiply base point by order and check for point at infinity */
359*5697Smcpowers MP_CHECKOK(ECPoint_mul(group, &group->order, &gx, &gy, &rx, &ry));
360*5697Smcpowers if (ectestPrint) {
361*5697Smcpowers printf(" (order)*P (ECPoint_mul):\n");
362*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
363*5697Smcpowers printf(" %s\n", s);
364*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
365*5697Smcpowers printf(" %s\n", s);
366*5697Smcpowers }
367*5697Smcpowers if (ec_GF2m_pt_is_inf_aff(&rx, &ry) != MP_YES) {
368*5697Smcpowers printf(" Error: invalid result (expected point at infinity).\n");
369*5697Smcpowers res = MP_NO;
370*5697Smcpowers goto CLEANUP;
371*5697Smcpowers }
372*5697Smcpowers
373*5697Smcpowers /* check that (order-1)P + (order-1)P + P == (order-1)P */
374*5697Smcpowers MP_CHECKOK(ECPoints_mul
375*5697Smcpowers (group, &order_1, &order_1, &gx, &gy, &rx, &ry));
376*5697Smcpowers MP_CHECKOK(ECPoints_mul(group, &one, &one, &rx, &ry, &rx, &ry));
377*5697Smcpowers if (ectestPrint) {
378*5697Smcpowers printf
379*5697Smcpowers (" (order-1)*P + (order-1)*P + P == (order-1)*P (ECPoints_mul):\n");
380*5697Smcpowers MP_CHECKOK(mp_toradix(&rx, s, 16));
381*5697Smcpowers printf(" %s\n", s);
382*5697Smcpowers MP_CHECKOK(mp_toradix(&ry, s, 16));
383*5697Smcpowers printf(" %s\n", s);
384*5697Smcpowers }
385*5697Smcpowers MP_CHECKOK(ec_GF2m_add(&ry, &rx, &ry, group->meth));
386*5697Smcpowers if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) {
387*5697Smcpowers printf(" Error: invalid result (expected (- base point)).\n");
388*5697Smcpowers res = MP_NO;
389*5697Smcpowers goto CLEANUP;
390*5697Smcpowers }
391*5697Smcpowers
392*5697Smcpowers /* test validate_point function */
393*5697Smcpowers if (ECPoint_validate(group, &gx, &gy) != MP_YES) {
394*5697Smcpowers printf(" Error: validate point on base point failed.\n");
395*5697Smcpowers res = MP_NO;
396*5697Smcpowers goto CLEANUP;
397*5697Smcpowers }
398*5697Smcpowers MP_CHECKOK(mp_add_d(&gy, 1, &ry));
399*5697Smcpowers if (ECPoint_validate(group, &gx, &ry) != MP_NO) {
400*5697Smcpowers printf(" Error: validate point on invalid point passed.\n");
401*5697Smcpowers res = MP_NO;
402*5697Smcpowers goto CLEANUP;
403*5697Smcpowers }
404*5697Smcpowers
405*5697Smcpowers if (ectestTime) {
406*5697Smcpowers /* compute random scalar */
407*5697Smcpowers size = mpl_significant_bits(&group->meth->irr);
408*5697Smcpowers if (size < MP_OKAY) {
409*5697Smcpowers goto CLEANUP;
410*5697Smcpowers }
411*5697Smcpowers MP_CHECKOK(mpp_random_size(&n, (size + ECL_BITS - 1) / ECL_BITS));
412*5697Smcpowers MP_CHECKOK(group->meth->field_mod(&n, &n, group->meth));
413*5697Smcpowers /* timed test */
414*5697Smcpowers if (generic) {
415*5697Smcpowers #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
416*5697Smcpowers M_TimeOperation(MP_CHECKOK
417*5697Smcpowers (ec_GF2m_pt_mul_aff
418*5697Smcpowers (&n, &group->genx, &group->geny, &rx, &ry,
419*5697Smcpowers group)), 100);
420*5697Smcpowers #endif
421*5697Smcpowers M_TimeOperation(MP_CHECKOK
422*5697Smcpowers (ECPoint_mul(group, &n, NULL, NULL, &rx, &ry)),
423*5697Smcpowers 100);
424*5697Smcpowers M_TimeOperation(MP_CHECKOK
425*5697Smcpowers (ECPoints_mul
426*5697Smcpowers (group, &n, &n, &gx, &gy, &rx, &ry)), 100);
427*5697Smcpowers } else {
428*5697Smcpowers M_TimeOperation(MP_CHECKOK
429*5697Smcpowers (ECPoint_mul(group, &n, NULL, NULL, &rx, &ry)),
430*5697Smcpowers 100);
431*5697Smcpowers M_TimeOperation(MP_CHECKOK
432*5697Smcpowers (ECPoint_mul(group, &n, &gx, &gy, &rx, &ry)),
433*5697Smcpowers 100);
434*5697Smcpowers M_TimeOperation(MP_CHECKOK
435*5697Smcpowers (ECPoints_mul
436*5697Smcpowers (group, &n, &n, &gx, &gy, &rx, &ry)), 100);
437*5697Smcpowers }
438*5697Smcpowers }
439*5697Smcpowers
440*5697Smcpowers CLEANUP:
441*5697Smcpowers mp_clear(&one);
442*5697Smcpowers mp_clear(&order_1);
443*5697Smcpowers mp_clear(&gx);
444*5697Smcpowers mp_clear(&gy);
445*5697Smcpowers mp_clear(&rx);
446*5697Smcpowers mp_clear(&ry);
447*5697Smcpowers mp_clear(&n);
448*5697Smcpowers if (res != MP_OKAY) {
449*5697Smcpowers #ifdef _KERNEL
450*5697Smcpowers printf(" Error: exiting with error value 0x%x\n", res);
451*5697Smcpowers #else
452*5697Smcpowers printf(" Error: exiting with error value %i\n", res);
453*5697Smcpowers #endif
454*5697Smcpowers }
455*5697Smcpowers return res;
456*5697Smcpowers }
457*5697Smcpowers
458*5697Smcpowers /* Performs tests of elliptic curve cryptography over binary polynomial
459*5697Smcpowers * fields. If tests fail, then it prints an error message, aborts, and
460*5697Smcpowers * returns an error code. Otherwise, returns 0. */
461*5697Smcpowers int
ec2_test()462*5697Smcpowers ec2_test()
463*5697Smcpowers {
464*5697Smcpowers int ectestTime = 0;
465*5697Smcpowers int ectestPrint = 0;
466*5697Smcpowers int i;
467*5697Smcpowers ECGroup *group = NULL;
468*5697Smcpowers ECCurveParams *params = NULL;
469*5697Smcpowers mp_err res;
470*5697Smcpowers
471*5697Smcpowers /* generic arithmetic tests */
472*5697Smcpowers ECTEST_GENERIC_GF2M("SECT-131R1", ECCurve_SECG_CHAR2_131R1);
473*5697Smcpowers
474*5697Smcpowers /* specific arithmetic tests */
475*5697Smcpowers ECTEST_NAMED_GF2M("NIST-K163", ECCurve_NIST_K163);
476*5697Smcpowers ECTEST_NAMED_GF2M("NIST-B163", ECCurve_NIST_B163);
477*5697Smcpowers ECTEST_NAMED_GF2M("NIST-K233", ECCurve_NIST_K233);
478*5697Smcpowers ECTEST_NAMED_GF2M("NIST-B233", ECCurve_NIST_B233);
479*5697Smcpowers ECTEST_NAMED_GF2M("NIST-K283", ECCurve_NIST_K283);
480*5697Smcpowers ECTEST_NAMED_GF2M("NIST-B283", ECCurve_NIST_B283);
481*5697Smcpowers ECTEST_NAMED_GF2M("NIST-K409", ECCurve_NIST_K409);
482*5697Smcpowers ECTEST_NAMED_GF2M("NIST-B409", ECCurve_NIST_B409);
483*5697Smcpowers ECTEST_NAMED_GF2M("NIST-K571", ECCurve_NIST_K571);
484*5697Smcpowers ECTEST_NAMED_GF2M("NIST-B571", ECCurve_NIST_B571);
485*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V1", ECCurve_X9_62_CHAR2_PNB163V1);
486*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V2", ECCurve_X9_62_CHAR2_PNB163V2);
487*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V3", ECCurve_X9_62_CHAR2_PNB163V3);
488*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB176V1", ECCurve_X9_62_CHAR2_PNB176V1);
489*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V1", ECCurve_X9_62_CHAR2_TNB191V1);
490*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V2", ECCurve_X9_62_CHAR2_TNB191V2);
491*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V3", ECCurve_X9_62_CHAR2_TNB191V3);
492*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB208W1", ECCurve_X9_62_CHAR2_PNB208W1);
493*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V1", ECCurve_X9_62_CHAR2_TNB239V1);
494*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V2", ECCurve_X9_62_CHAR2_TNB239V2);
495*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V3", ECCurve_X9_62_CHAR2_TNB239V3);
496*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB272W1", ECCurve_X9_62_CHAR2_PNB272W1);
497*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB304W1", ECCurve_X9_62_CHAR2_PNB304W1);
498*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB359V1", ECCurve_X9_62_CHAR2_TNB359V1);
499*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB368W1", ECCurve_X9_62_CHAR2_PNB368W1);
500*5697Smcpowers ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB431R1", ECCurve_X9_62_CHAR2_TNB431R1);
501*5697Smcpowers ECTEST_NAMED_GF2M("SECT-113R1", ECCurve_SECG_CHAR2_113R1);
502*5697Smcpowers ECTEST_NAMED_GF2M("SECT-113R2", ECCurve_SECG_CHAR2_113R2);
503*5697Smcpowers ECTEST_NAMED_GF2M("SECT-131R1", ECCurve_SECG_CHAR2_131R1);
504*5697Smcpowers ECTEST_NAMED_GF2M("SECT-131R2", ECCurve_SECG_CHAR2_131R2);
505*5697Smcpowers ECTEST_NAMED_GF2M("SECT-163K1", ECCurve_SECG_CHAR2_163K1);
506*5697Smcpowers ECTEST_NAMED_GF2M("SECT-163R1", ECCurve_SECG_CHAR2_163R1);
507*5697Smcpowers ECTEST_NAMED_GF2M("SECT-163R2", ECCurve_SECG_CHAR2_163R2);
508*5697Smcpowers ECTEST_NAMED_GF2M("SECT-193R1", ECCurve_SECG_CHAR2_193R1);
509*5697Smcpowers ECTEST_NAMED_GF2M("SECT-193R2", ECCurve_SECG_CHAR2_193R2);
510*5697Smcpowers ECTEST_NAMED_GF2M("SECT-233K1", ECCurve_SECG_CHAR2_233K1);
511*5697Smcpowers ECTEST_NAMED_GF2M("SECT-233R1", ECCurve_SECG_CHAR2_233R1);
512*5697Smcpowers ECTEST_NAMED_GF2M("SECT-239K1", ECCurve_SECG_CHAR2_239K1);
513*5697Smcpowers ECTEST_NAMED_GF2M("SECT-283K1", ECCurve_SECG_CHAR2_283K1);
514*5697Smcpowers ECTEST_NAMED_GF2M("SECT-283R1", ECCurve_SECG_CHAR2_283R1);
515*5697Smcpowers ECTEST_NAMED_GF2M("SECT-409K1", ECCurve_SECG_CHAR2_409K1);
516*5697Smcpowers ECTEST_NAMED_GF2M("SECT-409R1", ECCurve_SECG_CHAR2_409R1);
517*5697Smcpowers ECTEST_NAMED_GF2M("SECT-571K1", ECCurve_SECG_CHAR2_571K1);
518*5697Smcpowers ECTEST_NAMED_GF2M("SECT-571R1", ECCurve_SECG_CHAR2_571R1);
519*5697Smcpowers ECTEST_NAMED_GF2M("WTLS-1 (113)", ECCurve_WTLS_1);
520*5697Smcpowers ECTEST_NAMED_GF2M("WTLS-3 (163)", ECCurve_WTLS_3);
521*5697Smcpowers ECTEST_NAMED_GF2M("WTLS-4 (113)", ECCurve_WTLS_4);
522*5697Smcpowers ECTEST_NAMED_GF2M("WTLS-5 (163)", ECCurve_WTLS_5);
523*5697Smcpowers ECTEST_NAMED_GF2M("WTLS-10 (233)", ECCurve_WTLS_10);
524*5697Smcpowers ECTEST_NAMED_GF2M("WTLS-11 (233)", ECCurve_WTLS_11);
525*5697Smcpowers
526*5697Smcpowers CLEANUP:
527*5697Smcpowers EC_FreeCurveParams(params);
528*5697Smcpowers ECGroup_free(group);
529*5697Smcpowers if (res != MP_OKAY) {
530*5697Smcpowers #ifdef _KERNEL
531*5697Smcpowers printf("Error: exiting with error value 0x%x\n", res);
532*5697Smcpowers #else
533*5697Smcpowers printf("Error: exiting with error value %i\n", res);
534*5697Smcpowers #endif
535*5697Smcpowers }
536*5697Smcpowers return res;
537*5697Smcpowers }
538