1 /*
2  *  Elliptic curves over GF(p): curve-specific data and functions
3  *
4  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  *
19  *  This file is part of mbed TLS (https://tls.mbed.org)
20  */
21 
22 #if !defined(MBEDTLS_CONFIG_FILE)
23 #include "mbedtls/config.h"
24 #else
25 #include MBEDTLS_CONFIG_FILE
26 #endif
27 
28 #if defined(MBEDTLS_ECP_C)
29 
30 #include "mbedtls/ecp.h"
31 #include "mbedtls/platform_util.h"
32 
33 #include <string.h>
34 
35 #if !defined(MBEDTLS_ECP_ALT)
36 
37 /* Parameter validation macros based on platform_util.h */
38 #define ECP_VALIDATE_RET( cond )    \
39     MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
40 #define ECP_VALIDATE( cond )        \
41     MBEDTLS_INTERNAL_VALIDATE( cond )
42 
43 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
44     !defined(inline) && !defined(__cplusplus)
45 #define inline __inline
46 #endif
47 
48 /*
49  * Conversion macros for embedded constants:
50  * build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2
51  */
52 #if defined(MBEDTLS_HAVE_INT32)
53 
54 #define BYTES_TO_T_UINT_4( a, b, c, d )             \
55     ( (mbedtls_mpi_uint) a <<  0 ) |                          \
56     ( (mbedtls_mpi_uint) b <<  8 ) |                          \
57     ( (mbedtls_mpi_uint) c << 16 ) |                          \
58     ( (mbedtls_mpi_uint) d << 24 )
59 
60 #define BYTES_TO_T_UINT_2( a, b )                   \
61     BYTES_TO_T_UINT_4( a, b, 0, 0 )
62 
63 #define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
64     BYTES_TO_T_UINT_4( a, b, c, d ),                \
65     BYTES_TO_T_UINT_4( e, f, g, h )
66 
67 #else /* 64-bits */
68 
69 #define BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \
70     ( (mbedtls_mpi_uint) a <<  0 ) |                          \
71     ( (mbedtls_mpi_uint) b <<  8 ) |                          \
72     ( (mbedtls_mpi_uint) c << 16 ) |                          \
73     ( (mbedtls_mpi_uint) d << 24 ) |                          \
74     ( (mbedtls_mpi_uint) e << 32 ) |                          \
75     ( (mbedtls_mpi_uint) f << 40 ) |                          \
76     ( (mbedtls_mpi_uint) g << 48 ) |                          \
77     ( (mbedtls_mpi_uint) h << 56 )
78 
79 #define BYTES_TO_T_UINT_4( a, b, c, d )             \
80     BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 )
81 
82 #define BYTES_TO_T_UINT_2( a, b )                   \
83     BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 )
84 
85 #endif /* bits in mbedtls_mpi_uint */
86 
87 /*
88  * Note: the constants are in little-endian order
89  * to be directly usable in MPIs
90  */
91 
92 /*
93  * Domain parameters for secp192r1
94  */
95 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
96 static const mbedtls_mpi_uint secp192r1_p[] = {
97     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
98     BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
99     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
100 };
101 static const mbedtls_mpi_uint secp192r1_b[] = {
102     BYTES_TO_T_UINT_8( 0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE ),
103     BYTES_TO_T_UINT_8( 0x49, 0x30, 0x24, 0x72, 0xAB, 0xE9, 0xA7, 0x0F ),
104     BYTES_TO_T_UINT_8( 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64 ),
105 };
106 static const mbedtls_mpi_uint secp192r1_gx[] = {
107     BYTES_TO_T_UINT_8( 0x12, 0x10, 0xFF, 0x82, 0xFD, 0x0A, 0xFF, 0xF4 ),
108     BYTES_TO_T_UINT_8( 0x00, 0x88, 0xA1, 0x43, 0xEB, 0x20, 0xBF, 0x7C ),
109     BYTES_TO_T_UINT_8( 0xF6, 0x90, 0x30, 0xB0, 0x0E, 0xA8, 0x8D, 0x18 ),
110 };
111 static const mbedtls_mpi_uint secp192r1_gy[] = {
112     BYTES_TO_T_UINT_8( 0x11, 0x48, 0x79, 0x1E, 0xA1, 0x77, 0xF9, 0x73 ),
113     BYTES_TO_T_UINT_8( 0xD5, 0xCD, 0x24, 0x6B, 0xED, 0x11, 0x10, 0x63 ),
114     BYTES_TO_T_UINT_8( 0x78, 0xDA, 0xC8, 0xFF, 0x95, 0x2B, 0x19, 0x07 ),
115 };
116 static const mbedtls_mpi_uint secp192r1_n[] = {
117     BYTES_TO_T_UINT_8( 0x31, 0x28, 0xD2, 0xB4, 0xB1, 0xC9, 0x6B, 0x14 ),
118     BYTES_TO_T_UINT_8( 0x36, 0xF8, 0xDE, 0x99, 0xFF, 0xFF, 0xFF, 0xFF ),
119     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
120 };
121 #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
122 
123 /*
124  * Domain parameters for secp224r1
125  */
126 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
127 static const mbedtls_mpi_uint secp224r1_p[] = {
128     BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
129     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
130     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
131     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
132 };
133 static const mbedtls_mpi_uint secp224r1_b[] = {
134     BYTES_TO_T_UINT_8( 0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27 ),
135     BYTES_TO_T_UINT_8( 0xBA, 0xD8, 0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50 ),
136     BYTES_TO_T_UINT_8( 0x56, 0x32, 0x41, 0xF5, 0xAB, 0xB3, 0x04, 0x0C ),
137     BYTES_TO_T_UINT_4( 0x85, 0x0A, 0x05, 0xB4 ),
138 };
139 static const mbedtls_mpi_uint secp224r1_gx[] = {
140     BYTES_TO_T_UINT_8( 0x21, 0x1D, 0x5C, 0x11, 0xD6, 0x80, 0x32, 0x34 ),
141     BYTES_TO_T_UINT_8( 0x22, 0x11, 0xC2, 0x56, 0xD3, 0xC1, 0x03, 0x4A ),
142     BYTES_TO_T_UINT_8( 0xB9, 0x90, 0x13, 0x32, 0x7F, 0xBF, 0xB4, 0x6B ),
143     BYTES_TO_T_UINT_4( 0xBD, 0x0C, 0x0E, 0xB7 ),
144 };
145 static const mbedtls_mpi_uint secp224r1_gy[] = {
146     BYTES_TO_T_UINT_8( 0x34, 0x7E, 0x00, 0x85, 0x99, 0x81, 0xD5, 0x44 ),
147     BYTES_TO_T_UINT_8( 0x64, 0x47, 0x07, 0x5A, 0xA0, 0x75, 0x43, 0xCD ),
148     BYTES_TO_T_UINT_8( 0xE6, 0xDF, 0x22, 0x4C, 0xFB, 0x23, 0xF7, 0xB5 ),
149     BYTES_TO_T_UINT_4( 0x88, 0x63, 0x37, 0xBD ),
150 };
151 static const mbedtls_mpi_uint secp224r1_n[] = {
152     BYTES_TO_T_UINT_8( 0x3D, 0x2A, 0x5C, 0x5C, 0x45, 0x29, 0xDD, 0x13 ),
153     BYTES_TO_T_UINT_8( 0x3E, 0xF0, 0xB8, 0xE0, 0xA2, 0x16, 0xFF, 0xFF ),
154     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
155     BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
156 };
157 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
158 
159 /*
160  * Domain parameters for secp256r1
161  */
162 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
163 static const mbedtls_mpi_uint secp256r1_p[] = {
164     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
165     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
166     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
167     BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
168 };
169 static const mbedtls_mpi_uint secp256r1_b[] = {
170     BYTES_TO_T_UINT_8( 0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B ),
171     BYTES_TO_T_UINT_8( 0xF6, 0xB0, 0x53, 0xCC, 0xB0, 0x06, 0x1D, 0x65 ),
172     BYTES_TO_T_UINT_8( 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD, 0xEB, 0xB3 ),
173     BYTES_TO_T_UINT_8( 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A ),
174 };
175 static const mbedtls_mpi_uint secp256r1_gx[] = {
176     BYTES_TO_T_UINT_8( 0x96, 0xC2, 0x98, 0xD8, 0x45, 0x39, 0xA1, 0xF4 ),
177     BYTES_TO_T_UINT_8( 0xA0, 0x33, 0xEB, 0x2D, 0x81, 0x7D, 0x03, 0x77 ),
178     BYTES_TO_T_UINT_8( 0xF2, 0x40, 0xA4, 0x63, 0xE5, 0xE6, 0xBC, 0xF8 ),
179     BYTES_TO_T_UINT_8( 0x47, 0x42, 0x2C, 0xE1, 0xF2, 0xD1, 0x17, 0x6B ),
180 };
181 static const mbedtls_mpi_uint secp256r1_gy[] = {
182     BYTES_TO_T_UINT_8( 0xF5, 0x51, 0xBF, 0x37, 0x68, 0x40, 0xB6, 0xCB ),
183     BYTES_TO_T_UINT_8( 0xCE, 0x5E, 0x31, 0x6B, 0x57, 0x33, 0xCE, 0x2B ),
184     BYTES_TO_T_UINT_8( 0x16, 0x9E, 0x0F, 0x7C, 0x4A, 0xEB, 0xE7, 0x8E ),
185     BYTES_TO_T_UINT_8( 0x9B, 0x7F, 0x1A, 0xFE, 0xE2, 0x42, 0xE3, 0x4F ),
186 };
187 static const mbedtls_mpi_uint secp256r1_n[] = {
188     BYTES_TO_T_UINT_8( 0x51, 0x25, 0x63, 0xFC, 0xC2, 0xCA, 0xB9, 0xF3 ),
189     BYTES_TO_T_UINT_8( 0x84, 0x9E, 0x17, 0xA7, 0xAD, 0xFA, 0xE6, 0xBC ),
190     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
191     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
192 };
193 #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
194 
195 /*
196  * Domain parameters for secp384r1
197  */
198 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
199 static const mbedtls_mpi_uint secp384r1_p[] = {
200     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
201     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
202     BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
203     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
204     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
205     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
206 };
207 static const mbedtls_mpi_uint secp384r1_b[] = {
208     BYTES_TO_T_UINT_8( 0xEF, 0x2A, 0xEC, 0xD3, 0xED, 0xC8, 0x85, 0x2A ),
209     BYTES_TO_T_UINT_8( 0x9D, 0xD1, 0x2E, 0x8A, 0x8D, 0x39, 0x56, 0xC6 ),
210     BYTES_TO_T_UINT_8( 0x5A, 0x87, 0x13, 0x50, 0x8F, 0x08, 0x14, 0x03 ),
211     BYTES_TO_T_UINT_8( 0x12, 0x41, 0x81, 0xFE, 0x6E, 0x9C, 0x1D, 0x18 ),
212     BYTES_TO_T_UINT_8( 0x19, 0x2D, 0xF8, 0xE3, 0x6B, 0x05, 0x8E, 0x98 ),
213     BYTES_TO_T_UINT_8( 0xE4, 0xE7, 0x3E, 0xE2, 0xA7, 0x2F, 0x31, 0xB3 ),
214 };
215 static const mbedtls_mpi_uint secp384r1_gx[] = {
216     BYTES_TO_T_UINT_8( 0xB7, 0x0A, 0x76, 0x72, 0x38, 0x5E, 0x54, 0x3A ),
217     BYTES_TO_T_UINT_8( 0x6C, 0x29, 0x55, 0xBF, 0x5D, 0xF2, 0x02, 0x55 ),
218     BYTES_TO_T_UINT_8( 0x38, 0x2A, 0x54, 0x82, 0xE0, 0x41, 0xF7, 0x59 ),
219     BYTES_TO_T_UINT_8( 0x98, 0x9B, 0xA7, 0x8B, 0x62, 0x3B, 0x1D, 0x6E ),
220     BYTES_TO_T_UINT_8( 0x74, 0xAD, 0x20, 0xF3, 0x1E, 0xC7, 0xB1, 0x8E ),
221     BYTES_TO_T_UINT_8( 0x37, 0x05, 0x8B, 0xBE, 0x22, 0xCA, 0x87, 0xAA ),
222 };
223 static const mbedtls_mpi_uint secp384r1_gy[] = {
224     BYTES_TO_T_UINT_8( 0x5F, 0x0E, 0xEA, 0x90, 0x7C, 0x1D, 0x43, 0x7A ),
225     BYTES_TO_T_UINT_8( 0x9D, 0x81, 0x7E, 0x1D, 0xCE, 0xB1, 0x60, 0x0A ),
226     BYTES_TO_T_UINT_8( 0xC0, 0xB8, 0xF0, 0xB5, 0x13, 0x31, 0xDA, 0xE9 ),
227     BYTES_TO_T_UINT_8( 0x7C, 0x14, 0x9A, 0x28, 0xBD, 0x1D, 0xF4, 0xF8 ),
228     BYTES_TO_T_UINT_8( 0x29, 0xDC, 0x92, 0x92, 0xBF, 0x98, 0x9E, 0x5D ),
229     BYTES_TO_T_UINT_8( 0x6F, 0x2C, 0x26, 0x96, 0x4A, 0xDE, 0x17, 0x36 ),
230 };
231 static const mbedtls_mpi_uint secp384r1_n[] = {
232     BYTES_TO_T_UINT_8( 0x73, 0x29, 0xC5, 0xCC, 0x6A, 0x19, 0xEC, 0xEC ),
233     BYTES_TO_T_UINT_8( 0x7A, 0xA7, 0xB0, 0x48, 0xB2, 0x0D, 0x1A, 0x58 ),
234     BYTES_TO_T_UINT_8( 0xDF, 0x2D, 0x37, 0xF4, 0x81, 0x4D, 0x63, 0xC7 ),
235     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
236     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
237     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
238 };
239 #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
240 
241 /*
242  * Domain parameters for secp521r1
243  */
244 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
245 static const mbedtls_mpi_uint secp521r1_p[] = {
246     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
247     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
248     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
249     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
250     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
251     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
252     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
253     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
254     BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
255 };
256 static const mbedtls_mpi_uint secp521r1_b[] = {
257     BYTES_TO_T_UINT_8( 0x00, 0x3F, 0x50, 0x6B, 0xD4, 0x1F, 0x45, 0xEF ),
258     BYTES_TO_T_UINT_8( 0xF1, 0x34, 0x2C, 0x3D, 0x88, 0xDF, 0x73, 0x35 ),
259     BYTES_TO_T_UINT_8( 0x07, 0xBF, 0xB1, 0x3B, 0xBD, 0xC0, 0x52, 0x16 ),
260     BYTES_TO_T_UINT_8( 0x7B, 0x93, 0x7E, 0xEC, 0x51, 0x39, 0x19, 0x56 ),
261     BYTES_TO_T_UINT_8( 0xE1, 0x09, 0xF1, 0x8E, 0x91, 0x89, 0xB4, 0xB8 ),
262     BYTES_TO_T_UINT_8( 0xF3, 0x15, 0xB3, 0x99, 0x5B, 0x72, 0xDA, 0xA2 ),
263     BYTES_TO_T_UINT_8( 0xEE, 0x40, 0x85, 0xB6, 0xA0, 0x21, 0x9A, 0x92 ),
264     BYTES_TO_T_UINT_8( 0x1F, 0x9A, 0x1C, 0x8E, 0x61, 0xB9, 0x3E, 0x95 ),
265     BYTES_TO_T_UINT_2( 0x51, 0x00 ),
266 };
267 static const mbedtls_mpi_uint secp521r1_gx[] = {
268     BYTES_TO_T_UINT_8( 0x66, 0xBD, 0xE5, 0xC2, 0x31, 0x7E, 0x7E, 0xF9 ),
269     BYTES_TO_T_UINT_8( 0x9B, 0x42, 0x6A, 0x85, 0xC1, 0xB3, 0x48, 0x33 ),
270     BYTES_TO_T_UINT_8( 0xDE, 0xA8, 0xFF, 0xA2, 0x27, 0xC1, 0x1D, 0xFE ),
271     BYTES_TO_T_UINT_8( 0x28, 0x59, 0xE7, 0xEF, 0x77, 0x5E, 0x4B, 0xA1 ),
272     BYTES_TO_T_UINT_8( 0xBA, 0x3D, 0x4D, 0x6B, 0x60, 0xAF, 0x28, 0xF8 ),
273     BYTES_TO_T_UINT_8( 0x21, 0xB5, 0x3F, 0x05, 0x39, 0x81, 0x64, 0x9C ),
274     BYTES_TO_T_UINT_8( 0x42, 0xB4, 0x95, 0x23, 0x66, 0xCB, 0x3E, 0x9E ),
275     BYTES_TO_T_UINT_8( 0xCD, 0xE9, 0x04, 0x04, 0xB7, 0x06, 0x8E, 0x85 ),
276     BYTES_TO_T_UINT_2( 0xC6, 0x00 ),
277 };
278 static const mbedtls_mpi_uint secp521r1_gy[] = {
279     BYTES_TO_T_UINT_8( 0x50, 0x66, 0xD1, 0x9F, 0x76, 0x94, 0xBE, 0x88 ),
280     BYTES_TO_T_UINT_8( 0x40, 0xC2, 0x72, 0xA2, 0x86, 0x70, 0x3C, 0x35 ),
281     BYTES_TO_T_UINT_8( 0x61, 0x07, 0xAD, 0x3F, 0x01, 0xB9, 0x50, 0xC5 ),
282     BYTES_TO_T_UINT_8( 0x40, 0x26, 0xF4, 0x5E, 0x99, 0x72, 0xEE, 0x97 ),
283     BYTES_TO_T_UINT_8( 0x2C, 0x66, 0x3E, 0x27, 0x17, 0xBD, 0xAF, 0x17 ),
284     BYTES_TO_T_UINT_8( 0x68, 0x44, 0x9B, 0x57, 0x49, 0x44, 0xF5, 0x98 ),
285     BYTES_TO_T_UINT_8( 0xD9, 0x1B, 0x7D, 0x2C, 0xB4, 0x5F, 0x8A, 0x5C ),
286     BYTES_TO_T_UINT_8( 0x04, 0xC0, 0x3B, 0x9A, 0x78, 0x6A, 0x29, 0x39 ),
287     BYTES_TO_T_UINT_2( 0x18, 0x01 ),
288 };
289 static const mbedtls_mpi_uint secp521r1_n[] = {
290     BYTES_TO_T_UINT_8( 0x09, 0x64, 0x38, 0x91, 0x1E, 0xB7, 0x6F, 0xBB ),
291     BYTES_TO_T_UINT_8( 0xAE, 0x47, 0x9C, 0x89, 0xB8, 0xC9, 0xB5, 0x3B ),
292     BYTES_TO_T_UINT_8( 0xD0, 0xA5, 0x09, 0xF7, 0x48, 0x01, 0xCC, 0x7F ),
293     BYTES_TO_T_UINT_8( 0x6B, 0x96, 0x2F, 0xBF, 0x83, 0x87, 0x86, 0x51 ),
294     BYTES_TO_T_UINT_8( 0xFA, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
295     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
296     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
297     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
298     BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
299 };
300 #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
301 
302 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
303 static const mbedtls_mpi_uint secp192k1_p[] = {
304     BYTES_TO_T_UINT_8( 0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
305     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
306     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
307 };
308 static const mbedtls_mpi_uint secp192k1_a[] = {
309     BYTES_TO_T_UINT_2( 0x00, 0x00 ),
310 };
311 static const mbedtls_mpi_uint secp192k1_b[] = {
312     BYTES_TO_T_UINT_2( 0x03, 0x00 ),
313 };
314 static const mbedtls_mpi_uint secp192k1_gx[] = {
315     BYTES_TO_T_UINT_8( 0x7D, 0x6C, 0xE0, 0xEA, 0xB1, 0xD1, 0xA5, 0x1D ),
316     BYTES_TO_T_UINT_8( 0x34, 0xF4, 0xB7, 0x80, 0x02, 0x7D, 0xB0, 0x26 ),
317     BYTES_TO_T_UINT_8( 0xAE, 0xE9, 0x57, 0xC0, 0x0E, 0xF1, 0x4F, 0xDB ),
318 };
319 static const mbedtls_mpi_uint secp192k1_gy[] = {
320     BYTES_TO_T_UINT_8( 0x9D, 0x2F, 0x5E, 0xD9, 0x88, 0xAA, 0x82, 0x40 ),
321     BYTES_TO_T_UINT_8( 0x34, 0x86, 0xBE, 0x15, 0xD0, 0x63, 0x41, 0x84 ),
322     BYTES_TO_T_UINT_8( 0xA7, 0x28, 0x56, 0x9C, 0x6D, 0x2F, 0x2F, 0x9B ),
323 };
324 static const mbedtls_mpi_uint secp192k1_n[] = {
325     BYTES_TO_T_UINT_8( 0x8D, 0xFD, 0xDE, 0x74, 0x6A, 0x46, 0x69, 0x0F ),
326     BYTES_TO_T_UINT_8( 0x17, 0xFC, 0xF2, 0x26, 0xFE, 0xFF, 0xFF, 0xFF ),
327     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
328 };
329 #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
330 
331 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
332 static const mbedtls_mpi_uint secp224k1_p[] = {
333     BYTES_TO_T_UINT_8( 0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
334     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
335     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
336     BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
337 };
338 static const mbedtls_mpi_uint secp224k1_a[] = {
339     BYTES_TO_T_UINT_2( 0x00, 0x00 ),
340 };
341 static const mbedtls_mpi_uint secp224k1_b[] = {
342     BYTES_TO_T_UINT_2( 0x05, 0x00 ),
343 };
344 static const mbedtls_mpi_uint secp224k1_gx[] = {
345     BYTES_TO_T_UINT_8( 0x5C, 0xA4, 0xB7, 0xB6, 0x0E, 0x65, 0x7E, 0x0F ),
346     BYTES_TO_T_UINT_8( 0xA9, 0x75, 0x70, 0xE4, 0xE9, 0x67, 0xA4, 0x69 ),
347     BYTES_TO_T_UINT_8( 0xA1, 0x28, 0xFC, 0x30, 0xDF, 0x99, 0xF0, 0x4D ),
348     BYTES_TO_T_UINT_4( 0x33, 0x5B, 0x45, 0xA1 ),
349 };
350 static const mbedtls_mpi_uint secp224k1_gy[] = {
351     BYTES_TO_T_UINT_8( 0xA5, 0x61, 0x6D, 0x55, 0xDB, 0x4B, 0xCA, 0xE2 ),
352     BYTES_TO_T_UINT_8( 0x59, 0xBD, 0xB0, 0xC0, 0xF7, 0x19, 0xE3, 0xF7 ),
353     BYTES_TO_T_UINT_8( 0xD6, 0xFB, 0xCA, 0x82, 0x42, 0x34, 0xBA, 0x7F ),
354     BYTES_TO_T_UINT_4( 0xED, 0x9F, 0x08, 0x7E ),
355 };
356 static const mbedtls_mpi_uint secp224k1_n[] = {
357     BYTES_TO_T_UINT_8( 0xF7, 0xB1, 0x9F, 0x76, 0x71, 0xA9, 0xF0, 0xCA ),
358     BYTES_TO_T_UINT_8( 0x84, 0x61, 0xEC, 0xD2, 0xE8, 0xDC, 0x01, 0x00 ),
359     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
360     BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ),
361 };
362 #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
363 
364 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
365 static const mbedtls_mpi_uint secp256k1_p[] = {
366     BYTES_TO_T_UINT_8( 0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
367     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
368     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
369     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
370 };
371 static const mbedtls_mpi_uint secp256k1_a[] = {
372     BYTES_TO_T_UINT_2( 0x00, 0x00 ),
373 };
374 static const mbedtls_mpi_uint secp256k1_b[] = {
375     BYTES_TO_T_UINT_2( 0x07, 0x00 ),
376 };
377 static const mbedtls_mpi_uint secp256k1_gx[] = {
378     BYTES_TO_T_UINT_8( 0x98, 0x17, 0xF8, 0x16, 0x5B, 0x81, 0xF2, 0x59 ),
379     BYTES_TO_T_UINT_8( 0xD9, 0x28, 0xCE, 0x2D, 0xDB, 0xFC, 0x9B, 0x02 ),
380     BYTES_TO_T_UINT_8( 0x07, 0x0B, 0x87, 0xCE, 0x95, 0x62, 0xA0, 0x55 ),
381     BYTES_TO_T_UINT_8( 0xAC, 0xBB, 0xDC, 0xF9, 0x7E, 0x66, 0xBE, 0x79 ),
382 };
383 static const mbedtls_mpi_uint secp256k1_gy[] = {
384     BYTES_TO_T_UINT_8( 0xB8, 0xD4, 0x10, 0xFB, 0x8F, 0xD0, 0x47, 0x9C ),
385     BYTES_TO_T_UINT_8( 0x19, 0x54, 0x85, 0xA6, 0x48, 0xB4, 0x17, 0xFD ),
386     BYTES_TO_T_UINT_8( 0xA8, 0x08, 0x11, 0x0E, 0xFC, 0xFB, 0xA4, 0x5D ),
387     BYTES_TO_T_UINT_8( 0x65, 0xC4, 0xA3, 0x26, 0x77, 0xDA, 0x3A, 0x48 ),
388 };
389 static const mbedtls_mpi_uint secp256k1_n[] = {
390     BYTES_TO_T_UINT_8( 0x41, 0x41, 0x36, 0xD0, 0x8C, 0x5E, 0xD2, 0xBF ),
391     BYTES_TO_T_UINT_8( 0x3B, 0xA0, 0x48, 0xAF, 0xE6, 0xDC, 0xAE, 0xBA ),
392     BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
393     BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
394 };
395 #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
396 
397 /*
398  * Domain parameters for brainpoolP256r1 (RFC 5639 3.4)
399  */
400 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
401 static const mbedtls_mpi_uint brainpoolP256r1_p[] = {
402     BYTES_TO_T_UINT_8( 0x77, 0x53, 0x6E, 0x1F, 0x1D, 0x48, 0x13, 0x20 ),
403     BYTES_TO_T_UINT_8( 0x28, 0x20, 0x26, 0xD5, 0x23, 0xF6, 0x3B, 0x6E ),
404     BYTES_TO_T_UINT_8( 0x72, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
405     BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
406 };
407 static const mbedtls_mpi_uint brainpoolP256r1_a[] = {
408     BYTES_TO_T_UINT_8( 0xD9, 0xB5, 0x30, 0xF3, 0x44, 0x4B, 0x4A, 0xE9 ),
409     BYTES_TO_T_UINT_8( 0x6C, 0x5C, 0xDC, 0x26, 0xC1, 0x55, 0x80, 0xFB ),
410     BYTES_TO_T_UINT_8( 0xE7, 0xFF, 0x7A, 0x41, 0x30, 0x75, 0xF6, 0xEE ),
411     BYTES_TO_T_UINT_8( 0x57, 0x30, 0x2C, 0xFC, 0x75, 0x09, 0x5A, 0x7D ),
412 };
413 static const mbedtls_mpi_uint brainpoolP256r1_b[] = {
414     BYTES_TO_T_UINT_8( 0xB6, 0x07, 0x8C, 0xFF, 0x18, 0xDC, 0xCC, 0x6B ),
415     BYTES_TO_T_UINT_8( 0xCE, 0xE1, 0xF7, 0x5C, 0x29, 0x16, 0x84, 0x95 ),
416     BYTES_TO_T_UINT_8( 0xBF, 0x7C, 0xD7, 0xBB, 0xD9, 0xB5, 0x30, 0xF3 ),
417     BYTES_TO_T_UINT_8( 0x44, 0x4B, 0x4A, 0xE9, 0x6C, 0x5C, 0xDC, 0x26 ),
418 };
419 static const mbedtls_mpi_uint brainpoolP256r1_gx[] = {
420     BYTES_TO_T_UINT_8( 0x62, 0x32, 0xCE, 0x9A, 0xBD, 0x53, 0x44, 0x3A ),
421     BYTES_TO_T_UINT_8( 0xC2, 0x23, 0xBD, 0xE3, 0xE1, 0x27, 0xDE, 0xB9 ),
422     BYTES_TO_T_UINT_8( 0xAF, 0xB7, 0x81, 0xFC, 0x2F, 0x48, 0x4B, 0x2C ),
423     BYTES_TO_T_UINT_8( 0xCB, 0x57, 0x7E, 0xCB, 0xB9, 0xAE, 0xD2, 0x8B ),
424 };
425 static const mbedtls_mpi_uint brainpoolP256r1_gy[] = {
426     BYTES_TO_T_UINT_8( 0x97, 0x69, 0x04, 0x2F, 0xC7, 0x54, 0x1D, 0x5C ),
427     BYTES_TO_T_UINT_8( 0x54, 0x8E, 0xED, 0x2D, 0x13, 0x45, 0x77, 0xC2 ),
428     BYTES_TO_T_UINT_8( 0xC9, 0x1D, 0x61, 0x14, 0x1A, 0x46, 0xF8, 0x97 ),
429     BYTES_TO_T_UINT_8( 0xFD, 0xC4, 0xDA, 0xC3, 0x35, 0xF8, 0x7E, 0x54 ),
430 };
431 static const mbedtls_mpi_uint brainpoolP256r1_n[] = {
432     BYTES_TO_T_UINT_8( 0xA7, 0x56, 0x48, 0x97, 0x82, 0x0E, 0x1E, 0x90 ),
433     BYTES_TO_T_UINT_8( 0xF7, 0xA6, 0x61, 0xB5, 0xA3, 0x7A, 0x39, 0x8C ),
434     BYTES_TO_T_UINT_8( 0x71, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
435     BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
436 };
437 #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
438 
439 /*
440  * Domain parameters for brainpoolP384r1 (RFC 5639 3.6)
441  */
442 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
443 static const mbedtls_mpi_uint brainpoolP384r1_p[] = {
444     BYTES_TO_T_UINT_8( 0x53, 0xEC, 0x07, 0x31, 0x13, 0x00, 0x47, 0x87 ),
445     BYTES_TO_T_UINT_8( 0x71, 0x1A, 0x1D, 0x90, 0x29, 0xA7, 0xD3, 0xAC ),
446     BYTES_TO_T_UINT_8( 0x23, 0x11, 0xB7, 0x7F, 0x19, 0xDA, 0xB1, 0x12 ),
447     BYTES_TO_T_UINT_8( 0xB4, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
448     BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
449     BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
450 };
451 static const mbedtls_mpi_uint brainpoolP384r1_a[] = {
452     BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
453     BYTES_TO_T_UINT_8( 0xEB, 0xD4, 0x3A, 0x50, 0x4A, 0x81, 0xA5, 0x8A ),
454     BYTES_TO_T_UINT_8( 0x0F, 0xF9, 0x91, 0xBA, 0xEF, 0x65, 0x91, 0x13 ),
455     BYTES_TO_T_UINT_8( 0x87, 0x27, 0xB2, 0x4F, 0x8E, 0xA2, 0xBE, 0xC2 ),
456     BYTES_TO_T_UINT_8( 0xA0, 0xAF, 0x05, 0xCE, 0x0A, 0x08, 0x72, 0x3C ),
457     BYTES_TO_T_UINT_8( 0x0C, 0x15, 0x8C, 0x3D, 0xC6, 0x82, 0xC3, 0x7B ),
458 };
459 static const mbedtls_mpi_uint brainpoolP384r1_b[] = {
460     BYTES_TO_T_UINT_8( 0x11, 0x4C, 0x50, 0xFA, 0x96, 0x86, 0xB7, 0x3A ),
461     BYTES_TO_T_UINT_8( 0x94, 0xC9, 0xDB, 0x95, 0x02, 0x39, 0xB4, 0x7C ),
462     BYTES_TO_T_UINT_8( 0xD5, 0x62, 0xEB, 0x3E, 0xA5, 0x0E, 0x88, 0x2E ),
463     BYTES_TO_T_UINT_8( 0xA6, 0xD2, 0xDC, 0x07, 0xE1, 0x7D, 0xB7, 0x2F ),
464     BYTES_TO_T_UINT_8( 0x7C, 0x44, 0xF0, 0x16, 0x54, 0xB5, 0x39, 0x8B ),
465     BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
466 };
467 static const mbedtls_mpi_uint brainpoolP384r1_gx[] = {
468     BYTES_TO_T_UINT_8( 0x1E, 0xAF, 0xD4, 0x47, 0xE2, 0xB2, 0x87, 0xEF ),
469     BYTES_TO_T_UINT_8( 0xAA, 0x46, 0xD6, 0x36, 0x34, 0xE0, 0x26, 0xE8 ),
470     BYTES_TO_T_UINT_8( 0xE8, 0x10, 0xBD, 0x0C, 0xFE, 0xCA, 0x7F, 0xDB ),
471     BYTES_TO_T_UINT_8( 0xE3, 0x4F, 0xF1, 0x7E, 0xE7, 0xA3, 0x47, 0x88 ),
472     BYTES_TO_T_UINT_8( 0x6B, 0x3F, 0xC1, 0xB7, 0x81, 0x3A, 0xA6, 0xA2 ),
473     BYTES_TO_T_UINT_8( 0xFF, 0x45, 0xCF, 0x68, 0xF0, 0x64, 0x1C, 0x1D ),
474 };
475 static const mbedtls_mpi_uint brainpoolP384r1_gy[] = {
476     BYTES_TO_T_UINT_8( 0x15, 0x53, 0x3C, 0x26, 0x41, 0x03, 0x82, 0x42 ),
477     BYTES_TO_T_UINT_8( 0x11, 0x81, 0x91, 0x77, 0x21, 0x46, 0x46, 0x0E ),
478     BYTES_TO_T_UINT_8( 0x28, 0x29, 0x91, 0xF9, 0x4F, 0x05, 0x9C, 0xE1 ),
479     BYTES_TO_T_UINT_8( 0x64, 0x58, 0xEC, 0xFE, 0x29, 0x0B, 0xB7, 0x62 ),
480     BYTES_TO_T_UINT_8( 0x52, 0xD5, 0xCF, 0x95, 0x8E, 0xEB, 0xB1, 0x5C ),
481     BYTES_TO_T_UINT_8( 0xA4, 0xC2, 0xF9, 0x20, 0x75, 0x1D, 0xBE, 0x8A ),
482 };
483 static const mbedtls_mpi_uint brainpoolP384r1_n[] = {
484     BYTES_TO_T_UINT_8( 0x65, 0x65, 0x04, 0xE9, 0x02, 0x32, 0x88, 0x3B ),
485     BYTES_TO_T_UINT_8( 0x10, 0xC3, 0x7F, 0x6B, 0xAF, 0xB6, 0x3A, 0xCF ),
486     BYTES_TO_T_UINT_8( 0xA7, 0x25, 0x04, 0xAC, 0x6C, 0x6E, 0x16, 0x1F ),
487     BYTES_TO_T_UINT_8( 0xB3, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
488     BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
489     BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
490 };
491 #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
492 
493 /*
494  * Domain parameters for brainpoolP512r1 (RFC 5639 3.7)
495  */
496 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
497 static const mbedtls_mpi_uint brainpoolP512r1_p[] = {
498     BYTES_TO_T_UINT_8( 0xF3, 0x48, 0x3A, 0x58, 0x56, 0x60, 0xAA, 0x28 ),
499     BYTES_TO_T_UINT_8( 0x85, 0xC6, 0x82, 0x2D, 0x2F, 0xFF, 0x81, 0x28 ),
500     BYTES_TO_T_UINT_8( 0xE6, 0x80, 0xA3, 0xE6, 0x2A, 0xA1, 0xCD, 0xAE ),
501     BYTES_TO_T_UINT_8( 0x42, 0x68, 0xC6, 0x9B, 0x00, 0x9B, 0x4D, 0x7D ),
502     BYTES_TO_T_UINT_8( 0x71, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
503     BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
504     BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
505     BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
506 };
507 static const mbedtls_mpi_uint brainpoolP512r1_a[] = {
508     BYTES_TO_T_UINT_8( 0xCA, 0x94, 0xFC, 0x77, 0x4D, 0xAC, 0xC1, 0xE7 ),
509     BYTES_TO_T_UINT_8( 0xB9, 0xC7, 0xF2, 0x2B, 0xA7, 0x17, 0x11, 0x7F ),
510     BYTES_TO_T_UINT_8( 0xB5, 0xC8, 0x9A, 0x8B, 0xC9, 0xF1, 0x2E, 0x0A ),
511     BYTES_TO_T_UINT_8( 0xA1, 0x3A, 0x25, 0xA8, 0x5A, 0x5D, 0xED, 0x2D ),
512     BYTES_TO_T_UINT_8( 0xBC, 0x63, 0x98, 0xEA, 0xCA, 0x41, 0x34, 0xA8 ),
513     BYTES_TO_T_UINT_8( 0x10, 0x16, 0xF9, 0x3D, 0x8D, 0xDD, 0xCB, 0x94 ),
514     BYTES_TO_T_UINT_8( 0xC5, 0x4C, 0x23, 0xAC, 0x45, 0x71, 0x32, 0xE2 ),
515     BYTES_TO_T_UINT_8( 0x89, 0x3B, 0x60, 0x8B, 0x31, 0xA3, 0x30, 0x78 ),
516 };
517 static const mbedtls_mpi_uint brainpoolP512r1_b[] = {
518     BYTES_TO_T_UINT_8( 0x23, 0xF7, 0x16, 0x80, 0x63, 0xBD, 0x09, 0x28 ),
519     BYTES_TO_T_UINT_8( 0xDD, 0xE5, 0xBA, 0x5E, 0xB7, 0x50, 0x40, 0x98 ),
520     BYTES_TO_T_UINT_8( 0x67, 0x3E, 0x08, 0xDC, 0xCA, 0x94, 0xFC, 0x77 ),
521     BYTES_TO_T_UINT_8( 0x4D, 0xAC, 0xC1, 0xE7, 0xB9, 0xC7, 0xF2, 0x2B ),
522     BYTES_TO_T_UINT_8( 0xA7, 0x17, 0x11, 0x7F, 0xB5, 0xC8, 0x9A, 0x8B ),
523     BYTES_TO_T_UINT_8( 0xC9, 0xF1, 0x2E, 0x0A, 0xA1, 0x3A, 0x25, 0xA8 ),
524     BYTES_TO_T_UINT_8( 0x5A, 0x5D, 0xED, 0x2D, 0xBC, 0x63, 0x98, 0xEA ),
525     BYTES_TO_T_UINT_8( 0xCA, 0x41, 0x34, 0xA8, 0x10, 0x16, 0xF9, 0x3D ),
526 };
527 static const mbedtls_mpi_uint brainpoolP512r1_gx[] = {
528     BYTES_TO_T_UINT_8( 0x22, 0xF8, 0xB9, 0xBC, 0x09, 0x22, 0x35, 0x8B ),
529     BYTES_TO_T_UINT_8( 0x68, 0x5E, 0x6A, 0x40, 0x47, 0x50, 0x6D, 0x7C ),
530     BYTES_TO_T_UINT_8( 0x5F, 0x7D, 0xB9, 0x93, 0x7B, 0x68, 0xD1, 0x50 ),
531     BYTES_TO_T_UINT_8( 0x8D, 0xD4, 0xD0, 0xE2, 0x78, 0x1F, 0x3B, 0xFF ),
532     BYTES_TO_T_UINT_8( 0x8E, 0x09, 0xD0, 0xF4, 0xEE, 0x62, 0x3B, 0xB4 ),
533     BYTES_TO_T_UINT_8( 0xC1, 0x16, 0xD9, 0xB5, 0x70, 0x9F, 0xED, 0x85 ),
534     BYTES_TO_T_UINT_8( 0x93, 0x6A, 0x4C, 0x9C, 0x2E, 0x32, 0x21, 0x5A ),
535     BYTES_TO_T_UINT_8( 0x64, 0xD9, 0x2E, 0xD8, 0xBD, 0xE4, 0xAE, 0x81 ),
536 };
537 static const mbedtls_mpi_uint brainpoolP512r1_gy[] = {
538     BYTES_TO_T_UINT_8( 0x92, 0x08, 0xD8, 0x3A, 0x0F, 0x1E, 0xCD, 0x78 ),
539     BYTES_TO_T_UINT_8( 0x06, 0x54, 0xF0, 0xA8, 0x2F, 0x2B, 0xCA, 0xD1 ),
540     BYTES_TO_T_UINT_8( 0xAE, 0x63, 0x27, 0x8A, 0xD8, 0x4B, 0xCA, 0x5B ),
541     BYTES_TO_T_UINT_8( 0x5E, 0x48, 0x5F, 0x4A, 0x49, 0xDE, 0xDC, 0xB2 ),
542     BYTES_TO_T_UINT_8( 0x11, 0x81, 0x1F, 0x88, 0x5B, 0xC5, 0x00, 0xA0 ),
543     BYTES_TO_T_UINT_8( 0x1A, 0x7B, 0xA5, 0x24, 0x00, 0xF7, 0x09, 0xF2 ),
544     BYTES_TO_T_UINT_8( 0xFD, 0x22, 0x78, 0xCF, 0xA9, 0xBF, 0xEA, 0xC0 ),
545     BYTES_TO_T_UINT_8( 0xEC, 0x32, 0x63, 0x56, 0x5D, 0x38, 0xDE, 0x7D ),
546 };
547 static const mbedtls_mpi_uint brainpoolP512r1_n[] = {
548     BYTES_TO_T_UINT_8( 0x69, 0x00, 0xA9, 0x9C, 0x82, 0x96, 0x87, 0xB5 ),
549     BYTES_TO_T_UINT_8( 0xDD, 0xDA, 0x5D, 0x08, 0x81, 0xD3, 0xB1, 0x1D ),
550     BYTES_TO_T_UINT_8( 0x47, 0x10, 0xAC, 0x7F, 0x19, 0x61, 0x86, 0x41 ),
551     BYTES_TO_T_UINT_8( 0x19, 0x26, 0xA9, 0x4C, 0x41, 0x5C, 0x3E, 0x55 ),
552     BYTES_TO_T_UINT_8( 0x70, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
553     BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
554     BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
555     BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
556 };
557 #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
558 
559 /*
560  * Create an MPI from embedded constants
561  * (assumes len is an exact multiple of sizeof mbedtls_mpi_uint)
562  */
ecp_mpi_load(mbedtls_mpi * X,const mbedtls_mpi_uint * p,size_t len)563 static inline void ecp_mpi_load( mbedtls_mpi *X, const mbedtls_mpi_uint *p, size_t len )
564 {
565     X->s = 1;
566     X->n = len / sizeof( mbedtls_mpi_uint );
567     X->p = (mbedtls_mpi_uint *) p;
568 }
569 
570 /*
571  * Set an MPI to static value 1
572  */
ecp_mpi_set1(mbedtls_mpi * X)573 static inline void ecp_mpi_set1( mbedtls_mpi *X )
574 {
575     static mbedtls_mpi_uint one[] = { 1 };
576     X->s = 1;
577     X->n = 1;
578     X->p = one;
579 }
580 
581 /*
582  * Make group available from embedded constants
583  */
ecp_group_load(mbedtls_ecp_group * grp,const mbedtls_mpi_uint * p,size_t plen,const mbedtls_mpi_uint * a,size_t alen,const mbedtls_mpi_uint * b,size_t blen,const mbedtls_mpi_uint * gx,size_t gxlen,const mbedtls_mpi_uint * gy,size_t gylen,const mbedtls_mpi_uint * n,size_t nlen)584 static int ecp_group_load( mbedtls_ecp_group *grp,
585                            const mbedtls_mpi_uint *p,  size_t plen,
586                            const mbedtls_mpi_uint *a,  size_t alen,
587                            const mbedtls_mpi_uint *b,  size_t blen,
588                            const mbedtls_mpi_uint *gx, size_t gxlen,
589                            const mbedtls_mpi_uint *gy, size_t gylen,
590                            const mbedtls_mpi_uint *n,  size_t nlen)
591 {
592     ecp_mpi_load( &grp->P, p, plen );
593     if( a != NULL )
594         ecp_mpi_load( &grp->A, a, alen );
595     ecp_mpi_load( &grp->B, b, blen );
596     ecp_mpi_load( &grp->N, n, nlen );
597 
598     ecp_mpi_load( &grp->G.X, gx, gxlen );
599     ecp_mpi_load( &grp->G.Y, gy, gylen );
600     ecp_mpi_set1( &grp->G.Z );
601 
602     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
603     grp->nbits = mbedtls_mpi_bitlen( &grp->N );
604 
605     grp->h = 1;
606 
607     return( 0 );
608 }
609 
610 #if defined(MBEDTLS_ECP_NIST_OPTIM)
611 /* Forward declarations */
612 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
613 static int ecp_mod_p192( mbedtls_mpi * );
614 #endif
615 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
616 static int ecp_mod_p224( mbedtls_mpi * );
617 #endif
618 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
619 static int ecp_mod_p256( mbedtls_mpi * );
620 #endif
621 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
622 static int ecp_mod_p384( mbedtls_mpi * );
623 #endif
624 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
625 static int ecp_mod_p521( mbedtls_mpi * );
626 #endif
627 
628 #define NIST_MODP( P )      grp->modp = ecp_mod_ ## P;
629 #else
630 #define NIST_MODP( P )
631 #endif /* MBEDTLS_ECP_NIST_OPTIM */
632 
633 /* Additional forward declarations */
634 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
635 static int ecp_mod_p255( mbedtls_mpi * );
636 #endif
637 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
638 static int ecp_mod_p448( mbedtls_mpi * );
639 #endif
640 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
641 static int ecp_mod_p192k1( mbedtls_mpi * );
642 #endif
643 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
644 static int ecp_mod_p224k1( mbedtls_mpi * );
645 #endif
646 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
647 static int ecp_mod_p256k1( mbedtls_mpi * );
648 #endif
649 
650 #define LOAD_GROUP_A( G )   ecp_group_load( grp,            \
651                             G ## _p,  sizeof( G ## _p  ),   \
652                             G ## _a,  sizeof( G ## _a  ),   \
653                             G ## _b,  sizeof( G ## _b  ),   \
654                             G ## _gx, sizeof( G ## _gx ),   \
655                             G ## _gy, sizeof( G ## _gy ),   \
656                             G ## _n,  sizeof( G ## _n  ) )
657 
658 #define LOAD_GROUP( G )     ecp_group_load( grp,            \
659                             G ## _p,  sizeof( G ## _p  ),   \
660                             NULL,     0,                    \
661                             G ## _b,  sizeof( G ## _b  ),   \
662                             G ## _gx, sizeof( G ## _gx ),   \
663                             G ## _gy, sizeof( G ## _gy ),   \
664                             G ## _n,  sizeof( G ## _n  ) )
665 
666 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
667 /*
668  * Specialized function for creating the Curve25519 group
669  */
ecp_use_curve25519(mbedtls_ecp_group * grp)670 static int ecp_use_curve25519( mbedtls_ecp_group *grp )
671 {
672     int ret;
673 
674     /* Actually ( A + 2 ) / 4 */
675     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->A, 16, "01DB42" ) );
676 
677     /* P = 2^255 - 19 */
678     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
679     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 255 ) );
680     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 19 ) );
681     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
682 
683     /* N = 2^252 + 27742317777372353535851937790883648493 */
684     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->N, 16,
685                                               "14DEF9DEA2F79CD65812631A5CF5D3ED" ) );
686     MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 252, 1 ) );
687 
688     /* Y intentionally not set, since we use x/z coordinates.
689      * This is used as a marker to identify Montgomery curves! */
690     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.X, 9 ) );
691     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.Z, 1 ) );
692     mbedtls_mpi_free( &grp->G.Y );
693 
694     /* Actually, the required msb for private keys */
695     grp->nbits = 254;
696 
697 cleanup:
698     if( ret != 0 )
699         mbedtls_ecp_group_free( grp );
700 
701     return( ret );
702 }
703 #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
704 
705 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
706 /*
707  * Specialized function for creating the Curve448 group
708  */
ecp_use_curve448(mbedtls_ecp_group * grp)709 static int ecp_use_curve448( mbedtls_ecp_group *grp )
710 {
711     mbedtls_mpi Ns;
712     int ret;
713 
714     mbedtls_mpi_init( &Ns );
715 
716     /* Actually ( A + 2 ) / 4 */
717     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &grp->A, 16, "98AA" ) );
718 
719     /* P = 2^448 - 2^224 - 1 */
720     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
721     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 224 ) );
722     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 1 ) );
723     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 224 ) );
724     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 1 ) );
725     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
726 
727     /* Y intentionally not set, since we use x/z coordinates.
728      * This is used as a marker to identify Montgomery curves! */
729     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.X, 5 ) );
730     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.Z, 1 ) );
731     mbedtls_mpi_free( &grp->G.Y );
732 
733     /* N = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 */
734     MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 446, 1 ) );
735     MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &Ns, 16,
736                                               "8335DC163BB124B65129C96FDE933D8D723A70AADC873D6D54A7BB0D" ) );
737     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &grp->N, &grp->N, &Ns ) );
738 
739     /* Actually, the required msb for private keys */
740     grp->nbits = 447;
741 
742 cleanup:
743     mbedtls_mpi_free( &Ns );
744     if( ret != 0 )
745         mbedtls_ecp_group_free( grp );
746 
747     return( ret );
748 }
749 #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
750 
751 /*
752  * Set a group using well-known domain parameters
753  */
mbedtls_ecp_group_load(mbedtls_ecp_group * grp,mbedtls_ecp_group_id id)754 int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id )
755 {
756     ECP_VALIDATE_RET( grp != NULL );
757     mbedtls_ecp_group_free( grp );
758 
759     grp->id = id;
760 
761     switch( id )
762     {
763 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
764         case MBEDTLS_ECP_DP_SECP192R1:
765             NIST_MODP( p192 );
766             return( LOAD_GROUP( secp192r1 ) );
767 #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
768 
769 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
770         case MBEDTLS_ECP_DP_SECP224R1:
771             NIST_MODP( p224 );
772             return( LOAD_GROUP( secp224r1 ) );
773 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
774 
775 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
776         case MBEDTLS_ECP_DP_SECP256R1:
777             NIST_MODP( p256 );
778             return( LOAD_GROUP( secp256r1 ) );
779 #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
780 
781 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
782         case MBEDTLS_ECP_DP_SECP384R1:
783             NIST_MODP( p384 );
784             return( LOAD_GROUP( secp384r1 ) );
785 #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
786 
787 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
788         case MBEDTLS_ECP_DP_SECP521R1:
789             NIST_MODP( p521 );
790             return( LOAD_GROUP( secp521r1 ) );
791 #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
792 
793 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
794         case MBEDTLS_ECP_DP_SECP192K1:
795             grp->modp = ecp_mod_p192k1;
796             return( LOAD_GROUP_A( secp192k1 ) );
797 #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
798 
799 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
800         case MBEDTLS_ECP_DP_SECP224K1:
801             grp->modp = ecp_mod_p224k1;
802             return( LOAD_GROUP_A( secp224k1 ) );
803 #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
804 
805 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
806         case MBEDTLS_ECP_DP_SECP256K1:
807             grp->modp = ecp_mod_p256k1;
808             return( LOAD_GROUP_A( secp256k1 ) );
809 #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
810 
811 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
812         case MBEDTLS_ECP_DP_BP256R1:
813             return( LOAD_GROUP_A( brainpoolP256r1 ) );
814 #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
815 
816 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
817         case MBEDTLS_ECP_DP_BP384R1:
818             return( LOAD_GROUP_A( brainpoolP384r1 ) );
819 #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
820 
821 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
822         case MBEDTLS_ECP_DP_BP512R1:
823             return( LOAD_GROUP_A( brainpoolP512r1 ) );
824 #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
825 
826 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
827         case MBEDTLS_ECP_DP_CURVE25519:
828             grp->modp = ecp_mod_p255;
829             return( ecp_use_curve25519( grp ) );
830 #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
831 
832 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
833         case MBEDTLS_ECP_DP_CURVE448:
834             grp->modp = ecp_mod_p448;
835             return( ecp_use_curve448( grp ) );
836 #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
837 
838         default:
839             mbedtls_ecp_group_free( grp );
840             return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
841     }
842 }
843 
844 #if defined(MBEDTLS_ECP_NIST_OPTIM)
845 /*
846  * Fast reduction modulo the primes used by the NIST curves.
847  *
848  * These functions are critical for speed, but not needed for correct
849  * operations. So, we make the choice to heavily rely on the internals of our
850  * bignum library, which creates a tight coupling between these functions and
851  * our MPI implementation.  However, the coupling between the ECP module and
852  * MPI remains loose, since these functions can be deactivated at will.
853  */
854 
855 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
856 /*
857  * Compared to the way things are presented in FIPS 186-3 D.2,
858  * we proceed in columns, from right (least significant chunk) to left,
859  * adding chunks to N in place, and keeping a carry for the next chunk.
860  * This avoids moving things around in memory, and uselessly adding zeros,
861  * compared to the more straightforward, line-oriented approach.
862  *
863  * For this prime we need to handle data in chunks of 64 bits.
864  * Since this is always a multiple of our basic mbedtls_mpi_uint, we can
865  * use a mbedtls_mpi_uint * to designate such a chunk, and small loops to handle it.
866  */
867 
868 /* Add 64-bit chunks (dst += src) and update carry */
add64(mbedtls_mpi_uint * dst,mbedtls_mpi_uint * src,mbedtls_mpi_uint * carry)869 static inline void add64( mbedtls_mpi_uint *dst, mbedtls_mpi_uint *src, mbedtls_mpi_uint *carry )
870 {
871     unsigned char i;
872     mbedtls_mpi_uint c = 0;
873     for( i = 0; i < 8 / sizeof( mbedtls_mpi_uint ); i++, dst++, src++ )
874     {
875         *dst += c;      c  = ( *dst < c );
876         *dst += *src;   c += ( *dst < *src );
877     }
878     *carry += c;
879 }
880 
881 /* Add carry to a 64-bit chunk and update carry */
carry64(mbedtls_mpi_uint * dst,mbedtls_mpi_uint * carry)882 static inline void carry64( mbedtls_mpi_uint *dst, mbedtls_mpi_uint *carry )
883 {
884     unsigned char i;
885     for( i = 0; i < 8 / sizeof( mbedtls_mpi_uint ); i++, dst++ )
886     {
887         *dst += *carry;
888         *carry  = ( *dst < *carry );
889     }
890 }
891 
892 #define WIDTH       8 / sizeof( mbedtls_mpi_uint )
893 #define A( i )      N->p + i * WIDTH
894 #define ADD( i )    add64( p, A( i ), &c )
895 #define NEXT        p += WIDTH; carry64( p, &c )
896 #define LAST        p += WIDTH; *p = c; while( ++p < end ) *p = 0
897 
898 /*
899  * Fast quasi-reduction modulo p192 (FIPS 186-3 D.2.1)
900  */
ecp_mod_p192(mbedtls_mpi * N)901 static int ecp_mod_p192( mbedtls_mpi *N )
902 {
903     int ret;
904     mbedtls_mpi_uint c = 0;
905     mbedtls_mpi_uint *p, *end;
906 
907     /* Make sure we have enough blocks so that A(5) is legal */
908     MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, 6 * WIDTH ) );
909 
910     p = N->p;
911     end = p + N->n;
912 
913     ADD( 3 ); ADD( 5 );             NEXT; // A0 += A3 + A5
914     ADD( 3 ); ADD( 4 ); ADD( 5 );   NEXT; // A1 += A3 + A4 + A5
915     ADD( 4 ); ADD( 5 );             LAST; // A2 += A4 + A5
916 
917 cleanup:
918     return( ret );
919 }
920 
921 #undef WIDTH
922 #undef A
923 #undef ADD
924 #undef NEXT
925 #undef LAST
926 #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
927 
928 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) ||   \
929     defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ||   \
930     defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
931 /*
932  * The reader is advised to first understand ecp_mod_p192() since the same
933  * general structure is used here, but with additional complications:
934  * (1) chunks of 32 bits, and (2) subtractions.
935  */
936 
937 /*
938  * For these primes, we need to handle data in chunks of 32 bits.
939  * This makes it more complicated if we use 64 bits limbs in MPI,
940  * which prevents us from using a uniform access method as for p192.
941  *
942  * So, we define a mini abstraction layer to access 32 bit chunks,
943  * load them in 'cur' for work, and store them back from 'cur' when done.
944  *
945  * While at it, also define the size of N in terms of 32-bit chunks.
946  */
947 #define LOAD32      cur = A( i );
948 
949 #if defined(MBEDTLS_HAVE_INT32)  /* 32 bit */
950 
951 #define MAX32       N->n
952 #define A( j )      N->p[j]
953 #define STORE32     N->p[i] = cur;
954 
955 #else                               /* 64-bit */
956 
957 #define MAX32       N->n * 2
958 #define A( j ) j % 2 ? (uint32_t)( N->p[j/2] >> 32 ) : (uint32_t)( N->p[j/2] )
959 #define STORE32                                   \
960     if( i % 2 ) {                                 \
961         N->p[i/2] &= 0x00000000FFFFFFFF;          \
962         N->p[i/2] |= ((mbedtls_mpi_uint) cur) << 32;        \
963     } else {                                      \
964         N->p[i/2] &= 0xFFFFFFFF00000000;          \
965         N->p[i/2] |= (mbedtls_mpi_uint) cur;                \
966     }
967 
968 #endif /* sizeof( mbedtls_mpi_uint ) */
969 
970 /*
971  * Helpers for addition and subtraction of chunks, with signed carry.
972  */
add32(uint32_t * dst,uint32_t src,signed char * carry)973 static inline void add32( uint32_t *dst, uint32_t src, signed char *carry )
974 {
975     *dst += src;
976     *carry += ( *dst < src );
977 }
978 
sub32(uint32_t * dst,uint32_t src,signed char * carry)979 static inline void sub32( uint32_t *dst, uint32_t src, signed char *carry )
980 {
981     *carry -= ( *dst < src );
982     *dst -= src;
983 }
984 
985 #define ADD( j )    add32( &cur, A( j ), &c );
986 #define SUB( j )    sub32( &cur, A( j ), &c );
987 
988 /*
989  * Helpers for the main 'loop'
990  * (see fix_negative for the motivation of C)
991  */
992 #define INIT( b )                                           \
993     int ret;                                                \
994     signed char c = 0, cc;                                  \
995     uint32_t cur;                                           \
996     size_t i = 0, bits = b;                                 \
997     mbedtls_mpi C;                                                  \
998     mbedtls_mpi_uint Cp[ b / 8 / sizeof( mbedtls_mpi_uint) + 1 ];               \
999                                                             \
1000     C.s = 1;                                                \
1001     C.n = b / 8 / sizeof( mbedtls_mpi_uint) + 1;                      \
1002     C.p = Cp;                                               \
1003     memset( Cp, 0, C.n * sizeof( mbedtls_mpi_uint ) );                \
1004                                                             \
1005     MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, b * 2 / 8 / sizeof( mbedtls_mpi_uint ) ) ); \
1006     LOAD32;
1007 
1008 #define NEXT                    \
1009     STORE32; i++; LOAD32;       \
1010     cc = c; c = 0;              \
1011     if( cc < 0 )                \
1012         sub32( &cur, -cc, &c ); \
1013     else                        \
1014         add32( &cur, cc, &c );  \
1015 
1016 #define LAST                                    \
1017     STORE32; i++;                               \
1018     cur = c > 0 ? c : 0; STORE32;               \
1019     cur = 0; while( ++i < MAX32 ) { STORE32; }  \
1020     if( c < 0 ) fix_negative( N, c, &C, bits );
1021 
1022 /*
1023  * If the result is negative, we get it in the form
1024  * c * 2^(bits + 32) + N, with c negative and N positive shorter than 'bits'
1025  */
fix_negative(mbedtls_mpi * N,signed char c,mbedtls_mpi * C,size_t bits)1026 static inline int fix_negative( mbedtls_mpi *N, signed char c, mbedtls_mpi *C, size_t bits )
1027 {
1028     int ret;
1029 
1030     /* C = - c * 2^(bits + 32) */
1031 #if !defined(MBEDTLS_HAVE_INT64)
1032     ((void) bits);
1033 #else
1034     if( bits == 224 )
1035         C->p[ C->n - 1 ] = ((mbedtls_mpi_uint) -c) << 32;
1036     else
1037 #endif
1038         C->p[ C->n - 1 ] = (mbedtls_mpi_uint) -c;
1039 
1040     /* N = - ( C - N ) */
1041     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, C, N ) );
1042     N->s = -1;
1043 
1044 cleanup:
1045 
1046     return( ret );
1047 }
1048 
1049 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
1050 /*
1051  * Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
1052  */
ecp_mod_p224(mbedtls_mpi * N)1053 static int ecp_mod_p224( mbedtls_mpi *N )
1054 {
1055     INIT( 224 );
1056 
1057     SUB(  7 ); SUB( 11 );               NEXT; // A0 += -A7 - A11
1058     SUB(  8 ); SUB( 12 );               NEXT; // A1 += -A8 - A12
1059     SUB(  9 ); SUB( 13 );               NEXT; // A2 += -A9 - A13
1060     SUB( 10 ); ADD(  7 ); ADD( 11 );    NEXT; // A3 += -A10 + A7 + A11
1061     SUB( 11 ); ADD(  8 ); ADD( 12 );    NEXT; // A4 += -A11 + A8 + A12
1062     SUB( 12 ); ADD(  9 ); ADD( 13 );    NEXT; // A5 += -A12 + A9 + A13
1063     SUB( 13 ); ADD( 10 );               LAST; // A6 += -A13 + A10
1064 
1065 cleanup:
1066     return( ret );
1067 }
1068 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
1069 
1070 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
1071 /*
1072  * Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
1073  */
ecp_mod_p256(mbedtls_mpi * N)1074 static int ecp_mod_p256( mbedtls_mpi *N )
1075 {
1076     INIT( 256 );
1077 
1078     ADD(  8 ); ADD(  9 );
1079     SUB( 11 ); SUB( 12 ); SUB( 13 ); SUB( 14 );             NEXT; // A0
1080 
1081     ADD(  9 ); ADD( 10 );
1082     SUB( 12 ); SUB( 13 ); SUB( 14 ); SUB( 15 );             NEXT; // A1
1083 
1084     ADD( 10 ); ADD( 11 );
1085     SUB( 13 ); SUB( 14 ); SUB( 15 );                        NEXT; // A2
1086 
1087     ADD( 11 ); ADD( 11 ); ADD( 12 ); ADD( 12 ); ADD( 13 );
1088     SUB( 15 ); SUB(  8 ); SUB(  9 );                        NEXT; // A3
1089 
1090     ADD( 12 ); ADD( 12 ); ADD( 13 ); ADD( 13 ); ADD( 14 );
1091     SUB(  9 ); SUB( 10 );                                   NEXT; // A4
1092 
1093     ADD( 13 ); ADD( 13 ); ADD( 14 ); ADD( 14 ); ADD( 15 );
1094     SUB( 10 ); SUB( 11 );                                   NEXT; // A5
1095 
1096     ADD( 14 ); ADD( 14 ); ADD( 15 ); ADD( 15 ); ADD( 14 ); ADD( 13 );
1097     SUB(  8 ); SUB(  9 );                                   NEXT; // A6
1098 
1099     ADD( 15 ); ADD( 15 ); ADD( 15 ); ADD( 8 );
1100     SUB( 10 ); SUB( 11 ); SUB( 12 ); SUB( 13 );             LAST; // A7
1101 
1102 cleanup:
1103     return( ret );
1104 }
1105 #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
1106 
1107 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
1108 /*
1109  * Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4)
1110  */
ecp_mod_p384(mbedtls_mpi * N)1111 static int ecp_mod_p384( mbedtls_mpi *N )
1112 {
1113     INIT( 384 );
1114 
1115     ADD( 12 ); ADD( 21 ); ADD( 20 );
1116     SUB( 23 );                                              NEXT; // A0
1117 
1118     ADD( 13 ); ADD( 22 ); ADD( 23 );
1119     SUB( 12 ); SUB( 20 );                                   NEXT; // A2
1120 
1121     ADD( 14 ); ADD( 23 );
1122     SUB( 13 ); SUB( 21 );                                   NEXT; // A2
1123 
1124     ADD( 15 ); ADD( 12 ); ADD( 20 ); ADD( 21 );
1125     SUB( 14 ); SUB( 22 ); SUB( 23 );                        NEXT; // A3
1126 
1127     ADD( 21 ); ADD( 21 ); ADD( 16 ); ADD( 13 ); ADD( 12 ); ADD( 20 ); ADD( 22 );
1128     SUB( 15 ); SUB( 23 ); SUB( 23 );                        NEXT; // A4
1129 
1130     ADD( 22 ); ADD( 22 ); ADD( 17 ); ADD( 14 ); ADD( 13 ); ADD( 21 ); ADD( 23 );
1131     SUB( 16 );                                              NEXT; // A5
1132 
1133     ADD( 23 ); ADD( 23 ); ADD( 18 ); ADD( 15 ); ADD( 14 ); ADD( 22 );
1134     SUB( 17 );                                              NEXT; // A6
1135 
1136     ADD( 19 ); ADD( 16 ); ADD( 15 ); ADD( 23 );
1137     SUB( 18 );                                              NEXT; // A7
1138 
1139     ADD( 20 ); ADD( 17 ); ADD( 16 );
1140     SUB( 19 );                                              NEXT; // A8
1141 
1142     ADD( 21 ); ADD( 18 ); ADD( 17 );
1143     SUB( 20 );                                              NEXT; // A9
1144 
1145     ADD( 22 ); ADD( 19 ); ADD( 18 );
1146     SUB( 21 );                                              NEXT; // A10
1147 
1148     ADD( 23 ); ADD( 20 ); ADD( 19 );
1149     SUB( 22 );                                              LAST; // A11
1150 
1151 cleanup:
1152     return( ret );
1153 }
1154 #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
1155 
1156 #undef A
1157 #undef LOAD32
1158 #undef STORE32
1159 #undef MAX32
1160 #undef INIT
1161 #undef NEXT
1162 #undef LAST
1163 
1164 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
1165           MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
1166           MBEDTLS_ECP_DP_SECP384R1_ENABLED */
1167 
1168 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
1169 /*
1170  * Here we have an actual Mersenne prime, so things are more straightforward.
1171  * However, chunks are aligned on a 'weird' boundary (521 bits).
1172  */
1173 
1174 /* Size of p521 in terms of mbedtls_mpi_uint */
1175 #define P521_WIDTH      ( 521 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
1176 
1177 /* Bits to keep in the most significant mbedtls_mpi_uint */
1178 #define P521_MASK       0x01FF
1179 
1180 /*
1181  * Fast quasi-reduction modulo p521 (FIPS 186-3 D.2.5)
1182  * Write N as A1 + 2^521 A0, return A0 + A1
1183  */
ecp_mod_p521(mbedtls_mpi * N)1184 static int ecp_mod_p521( mbedtls_mpi *N )
1185 {
1186     int ret;
1187     size_t i;
1188     mbedtls_mpi M;
1189     mbedtls_mpi_uint Mp[P521_WIDTH + 1];
1190     /* Worst case for the size of M is when mbedtls_mpi_uint is 16 bits:
1191      * we need to hold bits 513 to 1056, which is 34 limbs, that is
1192      * P521_WIDTH + 1. Otherwise P521_WIDTH is enough. */
1193 
1194     if( N->n < P521_WIDTH )
1195         return( 0 );
1196 
1197     /* M = A1 */
1198     M.s = 1;
1199     M.n = N->n - ( P521_WIDTH - 1 );
1200     if( M.n > P521_WIDTH + 1 )
1201         M.n = P521_WIDTH + 1;
1202     M.p = Mp;
1203     memcpy( Mp, N->p + P521_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
1204     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 521 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
1205 
1206     /* N = A0 */
1207     N->p[P521_WIDTH - 1] &= P521_MASK;
1208     for( i = P521_WIDTH; i < N->n; i++ )
1209         N->p[i] = 0;
1210 
1211     /* N = A0 + A1 */
1212     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
1213 
1214 cleanup:
1215     return( ret );
1216 }
1217 
1218 #undef P521_WIDTH
1219 #undef P521_MASK
1220 #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
1221 
1222 #endif /* MBEDTLS_ECP_NIST_OPTIM */
1223 
1224 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
1225 
1226 /* Size of p255 in terms of mbedtls_mpi_uint */
1227 #define P255_WIDTH      ( 255 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
1228 
1229 /*
1230  * Fast quasi-reduction modulo p255 = 2^255 - 19
1231  * Write N as A0 + 2^255 A1, return A0 + 19 * A1
1232  */
ecp_mod_p255(mbedtls_mpi * N)1233 static int ecp_mod_p255( mbedtls_mpi *N )
1234 {
1235     int ret;
1236     size_t i;
1237     mbedtls_mpi M;
1238     mbedtls_mpi_uint Mp[P255_WIDTH + 2];
1239 
1240     if( N->n < P255_WIDTH )
1241         return( 0 );
1242 
1243     /* M = A1 */
1244     M.s = 1;
1245     M.n = N->n - ( P255_WIDTH - 1 );
1246     if( M.n > P255_WIDTH + 1 )
1247         return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
1248     M.p = Mp;
1249     memset( Mp, 0, sizeof Mp );
1250     memcpy( Mp, N->p + P255_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
1251     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 255 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
1252     M.n++; /* Make room for multiplication by 19 */
1253 
1254     /* N = A0 */
1255     MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( N, 255, 0 ) );
1256     for( i = P255_WIDTH; i < N->n; i++ )
1257         N->p[i] = 0;
1258 
1259     /* N = A0 + 19 * A1 */
1260     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &M, 19 ) );
1261     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
1262 
1263 cleanup:
1264     return( ret );
1265 }
1266 #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
1267 
1268 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
1269 
1270 /* Size of p448 in terms of mbedtls_mpi_uint */
1271 #define P448_WIDTH      ( 448 / 8 / sizeof( mbedtls_mpi_uint ) )
1272 
1273 /* Number of limbs fully occupied by 2^224 (max), and limbs used by it (min) */
1274 #define DIV_ROUND_UP( X, Y ) ( ( ( X ) + ( Y ) - 1 ) / ( Y ) )
1275 #define P224_WIDTH_MIN   ( 28 / sizeof( mbedtls_mpi_uint ) )
1276 #define P224_WIDTH_MAX   DIV_ROUND_UP( 28, sizeof( mbedtls_mpi_uint ) )
1277 #define P224_UNUSED_BITS ( ( P224_WIDTH_MAX * sizeof( mbedtls_mpi_uint ) * 8 ) - 224 )
1278 
1279 /*
1280  * Fast quasi-reduction modulo p448 = 2^448 - 2^224 - 1
1281  * Write N as A0 + 2^448 A1 and A1 as B0 + 2^224 B1, and return
1282  * A0 + A1 + B1 + (B0 + B1) * 2^224.  This is different to the reference
1283  * implementation of Curve448, which uses its own special 56-bit limbs rather
1284  * than a generic bignum library.  We could squeeze some extra speed out on
1285  * 32-bit machines by splitting N up into 32-bit limbs and doing the
1286  * arithmetic using the limbs directly as we do for the NIST primes above,
1287  * but for 64-bit targets it should use half the number of operations if we do
1288  * the reduction with 224-bit limbs, since mpi_add_mpi will then use 64-bit adds.
1289  */
ecp_mod_p448(mbedtls_mpi * N)1290 static int ecp_mod_p448( mbedtls_mpi *N )
1291 {
1292     int ret;
1293     size_t i;
1294     mbedtls_mpi M, Q;
1295     mbedtls_mpi_uint Mp[P448_WIDTH + 1], Qp[P448_WIDTH];
1296 
1297     if( N->n <= P448_WIDTH )
1298         return( 0 );
1299 
1300     /* M = A1 */
1301     M.s = 1;
1302     M.n = N->n - ( P448_WIDTH );
1303     if( M.n > P448_WIDTH )
1304         /* Shouldn't be called with N larger than 2^896! */
1305         return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
1306     M.p = Mp;
1307     memset( Mp, 0, sizeof( Mp ) );
1308     memcpy( Mp, N->p + P448_WIDTH, M.n * sizeof( mbedtls_mpi_uint ) );
1309 
1310     /* N = A0 */
1311     for( i = P448_WIDTH; i < N->n; i++ )
1312         N->p[i] = 0;
1313 
1314     /* N += A1 */
1315     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
1316 
1317     /* Q = B1, N += B1 */
1318     Q = M;
1319     Q.p = Qp;
1320     memcpy( Qp, Mp, sizeof( Qp ) );
1321     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &Q, 224 ) );
1322     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &Q ) );
1323 
1324     /* M = (B0 + B1) * 2^224, N += M */
1325     if( sizeof( mbedtls_mpi_uint ) > 4 )
1326         Mp[P224_WIDTH_MIN] &= ( (mbedtls_mpi_uint)-1 ) >> ( P224_UNUSED_BITS );
1327     for( i = P224_WIDTH_MAX; i < M.n; ++i )
1328         Mp[i] = 0;
1329     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &M, &M, &Q ) );
1330     M.n = P448_WIDTH + 1; /* Make room for shifted carry bit from the addition */
1331     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &M, 224 ) );
1332     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
1333 
1334 cleanup:
1335     return( ret );
1336 }
1337 #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
1338 
1339 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||   \
1340     defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||   \
1341     defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
1342 /*
1343  * Fast quasi-reduction modulo P = 2^s - R,
1344  * with R about 33 bits, used by the Koblitz curves.
1345  *
1346  * Write N as A0 + 2^224 A1, return A0 + R * A1.
1347  * Actually do two passes, since R is big.
1348  */
1349 #define P_KOBLITZ_MAX   ( 256 / 8 / sizeof( mbedtls_mpi_uint ) )  // Max limbs in P
1350 #define P_KOBLITZ_R     ( 8 / sizeof( mbedtls_mpi_uint ) )        // Limbs in R
ecp_mod_koblitz(mbedtls_mpi * N,mbedtls_mpi_uint * Rp,size_t p_limbs,size_t adjust,size_t shift,mbedtls_mpi_uint mask)1351 static inline int ecp_mod_koblitz( mbedtls_mpi *N, mbedtls_mpi_uint *Rp, size_t p_limbs,
1352                                    size_t adjust, size_t shift, mbedtls_mpi_uint mask )
1353 {
1354     int ret;
1355     size_t i;
1356     mbedtls_mpi M, R;
1357     mbedtls_mpi_uint Mp[P_KOBLITZ_MAX + P_KOBLITZ_R + 1];
1358 
1359     if( N->n < p_limbs )
1360         return( 0 );
1361 
1362     /* Init R */
1363     R.s = 1;
1364     R.p = Rp;
1365     R.n = P_KOBLITZ_R;
1366 
1367     /* Common setup for M */
1368     M.s = 1;
1369     M.p = Mp;
1370 
1371     /* M = A1 */
1372     M.n = N->n - ( p_limbs - adjust );
1373     if( M.n > p_limbs + adjust )
1374         M.n = p_limbs + adjust;
1375     memset( Mp, 0, sizeof Mp );
1376     memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
1377     if( shift != 0 )
1378         MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
1379     M.n += R.n; /* Make room for multiplication by R */
1380 
1381     /* N = A0 */
1382     if( mask != 0 )
1383         N->p[p_limbs - 1] &= mask;
1384     for( i = p_limbs; i < N->n; i++ )
1385         N->p[i] = 0;
1386 
1387     /* N = A0 + R * A1 */
1388     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &M, &M, &R ) );
1389     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
1390 
1391     /* Second pass */
1392 
1393     /* M = A1 */
1394     M.n = N->n - ( p_limbs - adjust );
1395     if( M.n > p_limbs + adjust )
1396         M.n = p_limbs + adjust;
1397     memset( Mp, 0, sizeof Mp );
1398     memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
1399     if( shift != 0 )
1400         MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
1401     M.n += R.n; /* Make room for multiplication by R */
1402 
1403     /* N = A0 */
1404     if( mask != 0 )
1405         N->p[p_limbs - 1] &= mask;
1406     for( i = p_limbs; i < N->n; i++ )
1407         N->p[i] = 0;
1408 
1409     /* N = A0 + R * A1 */
1410     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &M, &M, &R ) );
1411     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
1412 
1413 cleanup:
1414     return( ret );
1415 }
1416 #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||
1417           MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||
1418           MBEDTLS_ECP_DP_SECP256K1_ENABLED) */
1419 
1420 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
1421 /*
1422  * Fast quasi-reduction modulo p192k1 = 2^192 - R,
1423  * with R = 2^32 + 2^12 + 2^8 + 2^7 + 2^6 + 2^3 + 1 = 0x0100001119
1424  */
ecp_mod_p192k1(mbedtls_mpi * N)1425 static int ecp_mod_p192k1( mbedtls_mpi *N )
1426 {
1427     static mbedtls_mpi_uint Rp[] = {
1428         BYTES_TO_T_UINT_8( 0xC9, 0x11, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
1429 
1430     return( ecp_mod_koblitz( N, Rp, 192 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
1431 }
1432 #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
1433 
1434 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
1435 /*
1436  * Fast quasi-reduction modulo p224k1 = 2^224 - R,
1437  * with R = 2^32 + 2^12 + 2^11 + 2^9 + 2^7 + 2^4 + 2 + 1 = 0x0100001A93
1438  */
ecp_mod_p224k1(mbedtls_mpi * N)1439 static int ecp_mod_p224k1( mbedtls_mpi *N )
1440 {
1441     static mbedtls_mpi_uint Rp[] = {
1442         BYTES_TO_T_UINT_8( 0x93, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
1443 
1444 #if defined(MBEDTLS_HAVE_INT64)
1445     return( ecp_mod_koblitz( N, Rp, 4, 1, 32, 0xFFFFFFFF ) );
1446 #else
1447     return( ecp_mod_koblitz( N, Rp, 224 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
1448 #endif
1449 }
1450 
1451 #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
1452 
1453 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
1454 /*
1455  * Fast quasi-reduction modulo p256k1 = 2^256 - R,
1456  * with R = 2^32 + 2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1 = 0x01000003D1
1457  */
ecp_mod_p256k1(mbedtls_mpi * N)1458 static int ecp_mod_p256k1( mbedtls_mpi *N )
1459 {
1460     static mbedtls_mpi_uint Rp[] = {
1461         BYTES_TO_T_UINT_8( 0xD1, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ) };
1462     return( ecp_mod_koblitz( N, Rp, 256 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0, 0 ) );
1463 }
1464 #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
1465 
1466 #endif /* !MBEDTLS_ECP_ALT */
1467 
1468 #endif /* MBEDTLS_ECP_C */
1469