1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis 2 * 3 * LibTomCrypt is a library that provides various cryptographic 4 * algorithms in a highly modular and flexible manner. 5 * 6 * The library is free for all purposes without any express 7 * guarantee it works. 8 * 9 * Tom St Denis, tomstdenis (at) gmail.com, http://libtomcrypt.com 10 */ 11 12 /* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b 13 * 14 * All curves taken from NIST recommendation paper of July 1999 15 * Available at http://csrc.nist.gov/cryptval/dss.htm 16 */ 17 #include "tomcrypt.h" 18 19 /** 20 @file ltc_ecc_projective_add_point.c 21 ECC Crypto, Tom St Denis 22 */ 23 24 #if defined(MECC) && (!defined(MECC_ACCEL) || defined(LTM_DESC)) 25 26 /** 27 Add two ECC points 28 @param P The point to add 29 @param Q The point to add 30 @param R [out] The destination of the double 31 @param modulus The modulus of the field the ECC curve is in 32 @param mp The "b" value from montgomery_setup() 33 @return CRYPT_OK on success 34 */ 35 int ltc_ecc_projective_add_point(ecc_point *P, ecc_point *Q, ecc_point *R, void *modulus, void *mp) 36 { 37 void *t1, *t2, *x, *y, *z; 38 int err; 39 40 LTC_ARGCHK(P != NULL); 41 LTC_ARGCHK(Q != NULL); 42 LTC_ARGCHK(R != NULL); 43 LTC_ARGCHK(modulus != NULL); 44 LTC_ARGCHK(mp != NULL); 45 46 if ((err = mp_init_multi(&t1, &t2, &x, &y, &z, NULL)) != CRYPT_OK) { 47 return err; 48 } 49 50 /* should we dbl instead? */ 51 if ((err = mp_sub(modulus, Q->y, t1)) != CRYPT_OK) { goto done; } 52 53 if ( (mp_cmp(P->x, Q->x) == LTC_MP_EQ) && 54 (Q->z != NULL && mp_cmp(P->z, Q->z) == LTC_MP_EQ) && 55 (mp_cmp(P->y, Q->y) == LTC_MP_EQ || mp_cmp(P->y, t1) == LTC_MP_EQ)) { 56 mp_clear_multi(t1, t2, x, y, z, NULL); 57 return ltc_ecc_projective_dbl_point(P, R, modulus, mp); 58 } 59 60 if ((err = mp_copy(P->x, x)) != CRYPT_OK) { goto done; } 61 if ((err = mp_copy(P->y, y)) != CRYPT_OK) { goto done; } 62 if ((err = mp_copy(P->z, z)) != CRYPT_OK) { goto done; } 63 64 /* if Z is one then these are no-operations */ 65 if (Q->z != NULL) { 66 /* T1 = Z' * Z' */ 67 if ((err = mp_sqr(Q->z, t1)) != CRYPT_OK) { goto done; } 68 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 69 /* X = X * T1 */ 70 if ((err = mp_mul(t1, x, x)) != CRYPT_OK) { goto done; } 71 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; } 72 /* T1 = Z' * T1 */ 73 if ((err = mp_mul(Q->z, t1, t1)) != CRYPT_OK) { goto done; } 74 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 75 /* Y = Y * T1 */ 76 if ((err = mp_mul(t1, y, y)) != CRYPT_OK) { goto done; } 77 if ((err = mp_montgomery_reduce(y, modulus, mp)) != CRYPT_OK) { goto done; } 78 } 79 80 /* T1 = Z*Z */ 81 if ((err = mp_sqr(z, t1)) != CRYPT_OK) { goto done; } 82 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 83 /* T2 = X' * T1 */ 84 if ((err = mp_mul(Q->x, t1, t2)) != CRYPT_OK) { goto done; } 85 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; } 86 /* T1 = Z * T1 */ 87 if ((err = mp_mul(z, t1, t1)) != CRYPT_OK) { goto done; } 88 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 89 /* T1 = Y' * T1 */ 90 if ((err = mp_mul(Q->y, t1, t1)) != CRYPT_OK) { goto done; } 91 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 92 93 /* Y = Y - T1 */ 94 if ((err = mp_sub(y, t1, y)) != CRYPT_OK) { goto done; } 95 if (mp_cmp_d(y, 0) == LTC_MP_LT) { 96 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; } 97 } 98 /* T1 = 2T1 */ 99 if ((err = mp_add(t1, t1, t1)) != CRYPT_OK) { goto done; } 100 if (mp_cmp(t1, modulus) != LTC_MP_LT) { 101 if ((err = mp_sub(t1, modulus, t1)) != CRYPT_OK) { goto done; } 102 } 103 /* T1 = Y + T1 */ 104 if ((err = mp_add(t1, y, t1)) != CRYPT_OK) { goto done; } 105 if (mp_cmp(t1, modulus) != LTC_MP_LT) { 106 if ((err = mp_sub(t1, modulus, t1)) != CRYPT_OK) { goto done; } 107 } 108 /* X = X - T2 */ 109 if ((err = mp_sub(x, t2, x)) != CRYPT_OK) { goto done; } 110 if (mp_cmp_d(x, 0) == LTC_MP_LT) { 111 if ((err = mp_add(x, modulus, x)) != CRYPT_OK) { goto done; } 112 } 113 /* T2 = 2T2 */ 114 if ((err = mp_add(t2, t2, t2)) != CRYPT_OK) { goto done; } 115 if (mp_cmp(t2, modulus) != LTC_MP_LT) { 116 if ((err = mp_sub(t2, modulus, t2)) != CRYPT_OK) { goto done; } 117 } 118 /* T2 = X + T2 */ 119 if ((err = mp_add(t2, x, t2)) != CRYPT_OK) { goto done; } 120 if (mp_cmp(t2, modulus) != LTC_MP_LT) { 121 if ((err = mp_sub(t2, modulus, t2)) != CRYPT_OK) { goto done; } 122 } 123 124 /* if Z' != 1 */ 125 if (Q->z != NULL) { 126 /* Z = Z * Z' */ 127 if ((err = mp_mul(z, Q->z, z)) != CRYPT_OK) { goto done; } 128 if ((err = mp_montgomery_reduce(z, modulus, mp)) != CRYPT_OK) { goto done; } 129 } 130 131 /* Z = Z * X */ 132 if ((err = mp_mul(z, x, z)) != CRYPT_OK) { goto done; } 133 if ((err = mp_montgomery_reduce(z, modulus, mp)) != CRYPT_OK) { goto done; } 134 135 /* T1 = T1 * X */ 136 if ((err = mp_mul(t1, x, t1)) != CRYPT_OK) { goto done; } 137 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 138 /* X = X * X */ 139 if ((err = mp_sqr(x, x)) != CRYPT_OK) { goto done; } 140 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; } 141 /* T2 = T2 * x */ 142 if ((err = mp_mul(t2, x, t2)) != CRYPT_OK) { goto done; } 143 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; } 144 /* T1 = T1 * X */ 145 if ((err = mp_mul(t1, x, t1)) != CRYPT_OK) { goto done; } 146 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; } 147 148 /* X = Y*Y */ 149 if ((err = mp_sqr(y, x)) != CRYPT_OK) { goto done; } 150 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; } 151 /* X = X - T2 */ 152 if ((err = mp_sub(x, t2, x)) != CRYPT_OK) { goto done; } 153 if (mp_cmp_d(x, 0) == LTC_MP_LT) { 154 if ((err = mp_add(x, modulus, x)) != CRYPT_OK) { goto done; } 155 } 156 157 /* T2 = T2 - X */ 158 if ((err = mp_sub(t2, x, t2)) != CRYPT_OK) { goto done; } 159 if (mp_cmp_d(t2, 0) == LTC_MP_LT) { 160 if ((err = mp_add(t2, modulus, t2)) != CRYPT_OK) { goto done; } 161 } 162 /* T2 = T2 - X */ 163 if ((err = mp_sub(t2, x, t2)) != CRYPT_OK) { goto done; } 164 if (mp_cmp_d(t2, 0) == LTC_MP_LT) { 165 if ((err = mp_add(t2, modulus, t2)) != CRYPT_OK) { goto done; } 166 } 167 /* T2 = T2 * Y */ 168 if ((err = mp_mul(t2, y, t2)) != CRYPT_OK) { goto done; } 169 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; } 170 /* Y = T2 - T1 */ 171 if ((err = mp_sub(t2, t1, y)) != CRYPT_OK) { goto done; } 172 if (mp_cmp_d(y, 0) == LTC_MP_LT) { 173 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; } 174 } 175 /* Y = Y/2 */ 176 if (mp_isodd(y)) { 177 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; } 178 } 179 if ((err = mp_div_2(y, y)) != CRYPT_OK) { goto done; } 180 181 if ((err = mp_copy(x, R->x)) != CRYPT_OK) { goto done; } 182 if ((err = mp_copy(y, R->y)) != CRYPT_OK) { goto done; } 183 if ((err = mp_copy(z, R->z)) != CRYPT_OK) { goto done; } 184 185 err = CRYPT_OK; 186 done: 187 mp_clear_multi(t1, t2, x, y, z, NULL); 188 return err; 189 } 190 191 #endif 192 193 /* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c,v $ */ 194 /* $Revision: 1.13 $ */ 195 /* $Date: 2006/12/04 05:07:59 $ */ 196 197
