Botan  1.10.17
Public Types | Public Member Functions | Friends | List of all members
Botan::PointGFp Class Reference

#include <point_gfp.h>

Public Types

enum  Compression_Type { UNCOMPRESSED = 0, COMPRESSED = 1, HYBRID = 2 }
 

Public Member Functions

BigInt get_affine_x () const
 
BigInt get_affine_y () const
 
const CurveGFpget_curve () const
 
bool is_zero () const
 
PointGFpnegate ()
 
bool on_the_curve () const
 
PointGFpoperator*= (const BigInt &scalar)
 
PointGFpoperator+= (const PointGFp &rhs)
 
PointGFpoperator-= (const PointGFp &rhs)
 
bool operator== (const PointGFp &other) const
 
 PointGFp ()
 
 PointGFp (const CurveGFp &curve)
 
 PointGFp (const CurveGFp &curve, const BigInt &x, const BigInt &y)
 
void swap (PointGFp &other)
 

Friends

BOTAN_DLL PointGFp multi_exponentiate (const PointGFp &p1, const BigInt &z1, const PointGFp &p2, const BigInt &z2)
 
BOTAN_DLL PointGFp operator* (const BigInt &scalar, const PointGFp &point)
 

Detailed Description

This class represents one point on a curve of GF(p)

Definition at line 41 of file point_gfp.h.

Member Enumeration Documentation

◆ Compression_Type

Enumerator
UNCOMPRESSED 
COMPRESSED 
HYBRID 

Definition at line 44 of file point_gfp.h.

Constructor & Destructor Documentation

◆ PointGFp() [1/3]

Botan::PointGFp::PointGFp ( )
inline

Construct an uninitialized PointGFp

Definition at line 53 of file point_gfp.h.

Referenced by operator-=().

53 {}

◆ PointGFp() [2/3]

Botan::PointGFp::PointGFp ( const CurveGFp curve)

Construct the zero point

Parameters
curveThe base curve

Definition at line 18 of file point_gfp.cpp.

References Botan::CurveGFp::get_r2().

18  :
19  curve(curve), ws(2 * (curve.get_p_words() + 2))
20  {
21  coord_x = 0;
22  coord_y = monty_mult(1, curve.get_r2());
23  coord_z = 0;
24  }
size_t get_p_words() const
Definition: curve_gfp.h:89
const BigInt & get_r2() const
Definition: curve_gfp.h:69

◆ PointGFp() [3/3]

Botan::PointGFp::PointGFp ( const CurveGFp curve,
const BigInt x,
const BigInt y 
)

Construct a point from its affine coordinates

Parameters
curvethe base curve
xaffine x coordinate
yaffine y coordinate

Definition at line 26 of file point_gfp.cpp.

References Botan::CurveGFp::get_p(), and Botan::CurveGFp::get_r2().

26  :
27  curve(curve), ws(2 * (curve.get_p_words() + 2))
28  {
29  if(x <= 0 || x >= curve.get_p())
30  throw Invalid_Argument("Invalid PointGFp x");
31  if(y <= 0 || y >= curve.get_p())
32  throw Invalid_Argument("Invalid PointGFp y");
33  coord_x = monty_mult(x, curve.get_r2());
34  coord_y = monty_mult(y, curve.get_r2());
35  coord_z = monty_mult(1, curve.get_r2());
36  }
size_t get_p_words() const
Definition: curve_gfp.h:89
std::invalid_argument Invalid_Argument
Definition: exceptn.h:20
const BigInt & get_r2() const
Definition: curve_gfp.h:69
const BigInt & get_p() const
Definition: curve_gfp.h:64

Member Function Documentation

◆ get_affine_x()

BigInt Botan::PointGFp::get_affine_x ( ) const

get affine x coordinate

Returns
affine x coordinate

Definition at line 400 of file point_gfp.cpp.

References Botan::CurveGFp::get_p(), Botan::CurveGFp::get_r2(), Botan::inverse_mod(), and is_zero().

Referenced by Botan::ECDH_KA_Operation::agree(), Botan::EC2OSP(), and operator==().

401  {
402  if(is_zero())
403  throw Illegal_Transformation("Cannot convert zero point to affine");
404 
405  const BigInt& r2 = curve.get_r2();
406 
407  BigInt z2 = monty_sqr(coord_z);
408  z2 = inverse_mod(z2, curve.get_p());
409 
410  z2 = monty_mult(z2, r2);
411  return monty_mult(coord_x, z2);
412  }
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:314
const BigInt & get_r2() const
Definition: curve_gfp.h:69
bool is_zero() const
Definition: point_gfp.h:146
const BigInt & get_p() const
Definition: curve_gfp.h:64

◆ get_affine_y()

BigInt Botan::PointGFp::get_affine_y ( ) const

get affine y coordinate

Returns
affine y coordinate

Definition at line 414 of file point_gfp.cpp.

References Botan::CurveGFp::get_p(), Botan::CurveGFp::get_r2(), Botan::inverse_mod(), and is_zero().

Referenced by Botan::EC2OSP(), and operator==().

415  {
416  if(is_zero())
417  throw Illegal_Transformation("Cannot convert zero point to affine");
418 
419  const BigInt& r2 = curve.get_r2();
420 
421  BigInt z3 = monty_mult(coord_z, monty_sqr(coord_z));
422  z3 = inverse_mod(z3, curve.get_p());
423  z3 = monty_mult(z3, r2);
424  return monty_mult(coord_y, z3);
425  }
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:314
const BigInt & get_r2() const
Definition: curve_gfp.h:69
bool is_zero() const
Definition: point_gfp.h:146
const BigInt & get_p() const
Definition: curve_gfp.h:64

◆ get_curve()

const CurveGFp& Botan::PointGFp::get_curve ( ) const
inline

Return base curve of this point

Returns
the curve over GF(p) of this point

Definition at line 128 of file point_gfp.h.

Referenced by Botan::EC2OSP(), Botan::operator*(), and operator==().

128 { return curve; }

◆ is_zero()

bool Botan::PointGFp::is_zero ( ) const
inline

Is this the point at infinity?

Returns
true, if this point is at infinity, false otherwise.

Definition at line 146 of file point_gfp.h.

Referenced by Botan::EC2OSP(), get_affine_x(), get_affine_y(), on_the_curve(), operator-=(), and operator==().

147  { return (coord_x.is_zero() && coord_z.is_zero()); }
bool is_zero() const
Definition: bigint.h:176

◆ negate()

PointGFp& Botan::PointGFp::negate ( )
inline

Negate this point

Returns
*this

Definition at line 117 of file point_gfp.h.

References Botan::CT::is_zero().

Referenced by Botan::multi_exponentiate(), Botan::operator*(), and Botan::operator-().

118  {
119  if(!is_zero())
120  coord_y = curve.get_p() - coord_y;
121  return *this;
122  }
bool is_zero() const
Definition: point_gfp.h:146
const BigInt & get_p() const
Definition: curve_gfp.h:64

◆ on_the_curve()

bool Botan::PointGFp::on_the_curve ( ) const

Checks whether the point is to be found on the underlying curve; used to prevent fault attacks.

Returns
if the point is on the curve

Definition at line 427 of file point_gfp.cpp.

References Botan::CurveGFp::get_a_r(), Botan::CurveGFp::get_b_r(), and is_zero().

Referenced by Botan::ECDH_KA_Operation::agree(), Botan::EC_PublicKey::check_key(), Botan::EC_PrivateKey::EC_PrivateKey(), and Botan::OS2ECP().

428  {
429  /*
430  Is the point still on the curve?? (If everything is correct, the
431  point is always on its curve; then the function will return true.
432  If somehow the state is corrupted, which suggests a fault attack
433  (or internal computational error), then return false.
434  */
435 
436  if(is_zero())
437  return true;
438 
439  BigInt y2 = monty_mult(monty_sqr(coord_y), 1);
440  BigInt x3 = monty_mult(coord_x, monty_sqr(coord_x));
441 
442  BigInt ax = monty_mult(coord_x, curve.get_a_r());
443 
444  const BigInt& b_r = curve.get_b_r();
445 
446  BigInt z2 = monty_sqr(coord_z);
447 
448  if(coord_z == z2) // Is z equal to 1 (in Montgomery form)?
449  {
450  if(y2 != monty_mult(x3 + ax + b_r, 1))
451  return false;
452  }
453 
454  BigInt z3 = monty_mult(coord_z, z2);
455 
456  BigInt ax_z4 = monty_mult(ax, monty_sqr(z2));
457 
458  BigInt b_z6 = monty_mult(b_r, monty_sqr(z3));
459 
460  if(y2 != monty_mult(x3 + ax_z4 + b_z6, 1))
461  return false;
462 
463  return true;
464  }
const BigInt & get_b_r() const
Definition: curve_gfp.h:79
bool is_zero() const
Definition: point_gfp.h:146
const BigInt & get_a_r() const
Definition: curve_gfp.h:74

◆ operator*=()

PointGFp & Botan::PointGFp::operator*= ( const BigInt scalar)

*= Operator

Parameters
scalarthe PointGFp to multiply with *this
Returns
resulting PointGFp

Definition at line 259 of file point_gfp.cpp.

260  {
261  *this = scalar * *this;
262  return *this;
263  }

◆ operator+=()

PointGFp & Botan::PointGFp::operator+= ( const PointGFp rhs)

+= Operator

Parameters
rhsthe PointGFp to add to the local value
Returns
resulting PointGFp

Definition at line 240 of file point_gfp.cpp.

241  {
242  std::vector<BigInt> ws(9);
243  add(rhs, ws);
244  return *this;
245  }

◆ operator-=()

PointGFp & Botan::PointGFp::operator-= ( const PointGFp rhs)

-= Operator

Parameters
rhsthe PointGFp to subtract from the local value
Returns
resulting PointGFp

Definition at line 247 of file point_gfp.cpp.

References is_zero(), and PointGFp().

248  {
249  PointGFp minus_rhs = PointGFp(rhs).negate();
250 
251  if(is_zero())
252  *this = minus_rhs;
253  else
254  *this += minus_rhs;
255 
256  return *this;
257  }
bool is_zero() const
Definition: point_gfp.h:146

◆ operator==()

bool Botan::PointGFp::operator== ( const PointGFp other) const

Equality operator

Definition at line 476 of file point_gfp.cpp.

References get_affine_x(), get_affine_y(), get_curve(), and is_zero().

477  {
478  if(get_curve() != other.get_curve())
479  return false;
480 
481  // If this is zero, only equal if other is also zero
482  if(is_zero())
483  return other.is_zero();
484 
485  return (get_affine_x() == other.get_affine_x() &&
486  get_affine_y() == other.get_affine_y());
487  }
BigInt get_affine_x() const
Definition: point_gfp.cpp:400
BigInt get_affine_y() const
Definition: point_gfp.cpp:414
bool is_zero() const
Definition: point_gfp.h:146
const CurveGFp & get_curve() const
Definition: point_gfp.h:128

◆ swap()

void Botan::PointGFp::swap ( PointGFp other)

swaps the states of *this and other, does not throw!

Parameters
otherthe object to swap values with

Definition at line 467 of file point_gfp.cpp.

References Botan::CurveGFp::swap(), Botan::MemoryRegion< T >::swap(), and Botan::BigInt::swap().

468  {
469  curve.swap(other.curve);
470  coord_x.swap(other.coord_x);
471  coord_y.swap(other.coord_y);
472  coord_z.swap(other.coord_z);
473  ws.swap(other.ws);
474  }
void swap(BigInt &other)
Definition: bigint.cpp:107
void swap(CurveGFp &other)
Definition: curve_gfp.h:95
void swap(MemoryRegion< T > &other)
Definition: secmem.h:260

Friends And Related Function Documentation

◆ multi_exponentiate

BOTAN_DLL PointGFp multi_exponentiate ( const PointGFp p1,
const BigInt z1,
const PointGFp p2,
const BigInt z2 
)
friend

Multiexponentiation

Parameters
p1a point
z1a scalar
p2a point
z2a scalar
Returns
(p1 * z1 + p2 * z2)

Definition at line 265 of file point_gfp.cpp.

267  {
268  const PointGFp p3 = p1 + p2;
269 
270  PointGFp H(p1.curve); // create as zero
271  size_t bits_left = std::max(z1.bits(), z2.bits());
272 
273  std::vector<BigInt> ws(9);
274 
275  while(bits_left)
276  {
277  H.mult2(ws);
278 
279  const bool z1_b = z1.get_bit(bits_left - 1);
280  const bool z2_b = z2.get_bit(bits_left - 1);
281 
282  if(z1_b == true && z2_b == true)
283  H.add(p3, ws);
284  else if(z1_b)
285  H.add(p1, ws);
286  else if(z2_b)
287  H.add(p2, ws);
288 
289  --bits_left;
290  }
291 
292  if(z1.is_negative() != z2.is_negative())
293  H.negate();
294 
295  return H;
296  }
T max(T a, T b)
Definition: ct_utils.h:120

◆ operator*

BOTAN_DLL PointGFp operator* ( const BigInt scalar,
const PointGFp point 
)
friend

Multiplication Operator

Parameters
scalarthe scalar value
pointthe point value
Returns
scalar*point on the curve

Definition at line 298 of file point_gfp.cpp.

299  {
300  const CurveGFp& curve = point.get_curve();
301 
302  if(scalar.is_zero())
303  return PointGFp(curve); // zero point
304 
305  std::vector<BigInt> ws(9);
306 
307  if(scalar.abs() <= 2) // special cases for small values
308  {
309  byte value = scalar.abs().byte_at(0);
310 
311  PointGFp result = point;
312 
313  if(value == 2)
314  result.mult2(ws);
315 
316  if(scalar.is_negative())
317  result.negate();
318 
319  return result;
320  }
321 
322  const size_t scalar_bits = scalar.bits();
323 
324 #if 0
325 
326  PointGFp x1 = PointGFp(curve);
327  PointGFp x2 = point;
328 
329  size_t bits_left = scalar_bits;
330 
331  // Montgomery Ladder
332  while(bits_left)
333  {
334  const bool bit_set = scalar.get_bit(bits_left - 1);
335 
336  if(bit_set)
337  {
338  x1.add(x2, ws);
339  x2.mult2(ws);
340  }
341  else
342  {
343  x2.add(x1, ws);
344  x1.mult2(ws);
345  }
346 
347  --bits_left;
348  }
349 
350  if(scalar.is_negative())
351  x1.negate();
352 
353  return x1;
354 
355 #else
356  const size_t window_size = 4;
357 
358  std::vector<PointGFp> Ps(1 << window_size);
359  Ps[0] = PointGFp(curve);
360  Ps[1] = point;
361 
362  for(size_t i = 2; i != Ps.size(); ++i)
363  {
364  Ps[i] = Ps[i-1];
365  Ps[i].add(point, ws);
366  }
367 
368  PointGFp H(curve); // create as zero
369  size_t bits_left = scalar_bits;
370 
371  while(bits_left >= window_size)
372  {
373  for(size_t i = 0; i != window_size; ++i)
374  H.mult2(ws);
375 
376  const u32bit nibble = scalar.get_substring(bits_left - window_size,
377  window_size);
378 
379  H.add(Ps[nibble], ws);
380 
381  bits_left -= window_size;
382  }
383 
384  while(bits_left)
385  {
386  H.mult2(ws);
387  if(scalar.get_bit(bits_left-1))
388  H.add(point, ws);
389 
390  --bits_left;
391  }
392 
393  if(scalar.is_negative())
394  H.negate();
395 
396  return H;
397 #endif
398  }
unsigned char byte
Definition: types.h:22
unsigned int u32bit
Definition: types.h:32

The documentation for this class was generated from the following files: