2 * ***** BEGIN LICENSE BLOCK *****
3 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
5 * The contents of this file are subject to the Mozilla Public License Version
6 * 1.1 (the "License"); you may not use this file except in compliance with
7 * the License. You may obtain a copy of the License at
8 * http://www.mozilla.org/MPL/
10 * Software distributed under the License is distributed on an "AS IS" basis,
11 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
12 * for the specific language governing rights and limitations under the
15 * The Original Code is the elliptic curve math library for binary polynomial field curves.
17 * The Initial Developer of the Original Code is
18 * Sun Microsystems, Inc.
19 * Portions created by the Initial Developer are Copyright (C) 2003
20 * the Initial Developer. All Rights Reserved.
23 * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories
25 * Alternatively, the contents of this file may be used under the terms of
26 * either the GNU General Public License Version 2 or later (the "GPL"), or
27 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
28 * in which case the provisions of the GPL or the LGPL are applicable instead
29 * of those above. If you wish to allow use of your version of this file only
30 * under the terms of either the GPL or the LGPL, and not to allow others to
31 * use your version of this file under the terms of the MPL, indicate your
32 * decision by deleting the provisions above and replace them with the notice
33 * and other provisions required by the GPL or the LGPL. If you do not delete
34 * the provisions above, a recipient may use your version of this file under
35 * the terms of any one of the MPL, the GPL or the LGPL.
37 * ***** END LICENSE BLOCK ***** */
39 * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
40 * Use is subject to license terms.
42 * Sun elects to use this software under the MPL license.
45 #pragma ident "%Z%%M% %I% %E% SMI"
48 #include <sys/types.h>
49 #include <sys/systm.h>
50 #include <sys/param.h>
51 #include <sys/modctl.h>
53 #include <sys/crypto/spi.h>
54 #include <sys/sysmacros.h>
55 #include <sys/strsun.h>
59 #include <sys/random.h>
61 #include <sys/devops.h>
62 #include <sys/sunddi.h>
63 #include <sys/varargs.h>
65 #include <sys/kstat.h>
66 #include <sys/crypto/common.h>
74 #include <sys/resource.h>
82 #include "ecl-curve.h"
92 /* Time k repetitions of operation op. */
93 #define M_TimeOperation(op, k) { \
94 double dStart, dNow, dUserTime; \
97 getrusage(RUSAGE_SELF, &ru); \
98 dStart = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \
99 for (i = 0; i < k; i++) { \
102 getrusage(RUSAGE_SELF, &ru); \
103 dNow = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \
104 dUserTime = dNow-dStart; \
105 if (dUserTime) printf(" %-45s k: %6i, t: %6.2f sec\n", #op, k, dUserTime); \
108 #define M_TimeOperation(op, k)
111 /* Test curve using generic field arithmetic. */
112 #define ECTEST_GENERIC_GF2M(name_c, name) \
113 printf("Testing %s using generic implementation...\n", name_c); \
114 params = EC_GetNamedCurveParams(name, KM_SLEEP); \
115 if (params == NULL) { \
116 printf(" Error: could not construct params.\n"); \
120 ECGroup_free(group); \
121 group = ECGroup_fromHex(params, KM_SLEEP); \
122 if (group == NULL) { \
123 printf(" Error: could not construct group.\n"); \
127 MP_CHECKOK( ectest_curve_GF2m(group, ectestPrint, ectestTime, 1, KM_SLEEP) ); \
128 printf("... okay.\n");
130 /* Test curve using specific field arithmetic. */
131 #define ECTEST_NAMED_GF2M(name_c, name) \
132 printf("Testing %s using specific implementation...\n", name_c); \
133 ECGroup_free(group); \
134 group = ECGroup_fromName(name, KM_SLEEP); \
135 if (group == NULL) { \
136 printf(" Warning: could not construct group.\n"); \
137 printf("... failed; continuing with remaining tests.\n"); \
139 MP_CHECKOK( ectest_curve_GF2m(group, ectestPrint, ectestTime, 0, KM_SLEEP) ); \
140 printf("... okay.\n"); \
143 /* Performs basic tests of elliptic curve cryptography over binary
144 * polynomial fields. If tests fail, then it prints an error message,
145 * aborts, and returns an error code. Otherwise, returns 0. */
147 ectest_curve_GF2m(ECGroup
*group
, int ectestPrint
, int ectestTime
,
148 int generic
, int kmflag
)
151 mp_int one
, order_1
, gx
, gy
, rx
, ry
, n
;
156 /* initialize values */
157 MP_CHECKOK(mp_init(&one
, kmflag
));
158 MP_CHECKOK(mp_init(&order_1
, kmflag
));
159 MP_CHECKOK(mp_init(&gx
, kmflag
));
160 MP_CHECKOK(mp_init(&gy
, kmflag
));
161 MP_CHECKOK(mp_init(&rx
, kmflag
));
162 MP_CHECKOK(mp_init(&ry
, kmflag
));
163 MP_CHECKOK(mp_init(&n
, kmflag
));
165 MP_CHECKOK(mp_set_int(&one
, 1));
166 MP_CHECKOK(mp_sub(&group
->order
, &one
, &order_1
));
168 /* encode base point */
169 if (group
->meth
->field_dec
) {
170 MP_CHECKOK(group
->meth
->field_dec(&group
->genx
, &gx
, group
->meth
));
171 MP_CHECKOK(group
->meth
->field_dec(&group
->geny
, &gy
, group
->meth
));
173 MP_CHECKOK(mp_copy(&group
->genx
, &gx
));
174 MP_CHECKOK(mp_copy(&group
->geny
, &gy
));
178 /* output base point */
179 printf(" base point P:\n");
180 MP_CHECKOK(mp_toradix(&gx
, s
, 16));
182 MP_CHECKOK(mp_toradix(&gy
, s
, 16));
184 if (group
->meth
->field_enc
) {
185 printf(" base point P (encoded):\n");
186 MP_CHECKOK(mp_toradix(&group
->genx
, s
, 16));
188 MP_CHECKOK(mp_toradix(&group
->geny
, s
, 16));
193 #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
194 /* multiply base point by order - 1 and check for negative of base
196 MP_CHECKOK(ec_GF2m_pt_mul_aff
197 (&order_1
, &group
->genx
, &group
->geny
, &rx
, &ry
, group
));
199 printf(" (order-1)*P (affine):\n");
200 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
202 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
205 MP_CHECKOK(group
->meth
->field_add(&ry
, &rx
, &ry
, group
->meth
));
206 if ((mp_cmp(&rx
, &group
->genx
) != 0)
207 || (mp_cmp(&ry
, &group
->geny
) != 0)) {
208 printf(" Error: invalid result (expected (- base point)).\n");
214 /* multiply base point by order - 1 and check for negative of base
216 MP_CHECKOK(ec_GF2m_pt_mul_mont
217 (&order_1
, &group
->genx
, &group
->geny
, &rx
, &ry
, group
));
219 printf(" (order-1)*P (montgomery):\n");
220 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
222 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
225 MP_CHECKOK(group
->meth
->field_add(&ry
, &rx
, &ry
, group
->meth
));
226 if ((mp_cmp(&rx
, &group
->genx
) != 0)
227 || (mp_cmp(&ry
, &group
->geny
) != 0)) {
228 printf(" Error: invalid result (expected (- base point)).\n");
233 #ifdef ECL_ENABLE_GF2M_PROJ
234 /* multiply base point by order - 1 and check for negative of base
236 MP_CHECKOK(ec_GF2m_pt_mul_proj
237 (&order_1
, &group
->genx
, &group
->geny
, &rx
, &ry
, group
));
239 printf(" (order-1)*P (projective):\n");
240 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
242 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
245 MP_CHECKOK(group
->meth
->field_add(&ry
, &rx
, &ry
, group
->meth
));
246 if ((mp_cmp(&rx
, &group
->genx
) != 0)
247 || (mp_cmp(&ry
, &group
->geny
) != 0)) {
248 printf(" Error: invalid result (expected (- base point)).\n");
254 /* multiply base point by order - 1 and check for negative of base
256 MP_CHECKOK(ECPoint_mul(group
, &order_1
, NULL
, NULL
, &rx
, &ry
));
258 printf(" (order-1)*P (ECPoint_mul):\n");
259 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
261 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
264 MP_CHECKOK(ec_GF2m_add(&ry
, &rx
, &ry
, group
->meth
));
265 if ((mp_cmp(&rx
, &gx
) != 0) || (mp_cmp(&ry
, &gy
) != 0)) {
266 printf(" Error: invalid result (expected (- base point)).\n");
271 /* multiply base point by order - 1 and check for negative of base
273 MP_CHECKOK(ECPoint_mul(group
, &order_1
, &gx
, &gy
, &rx
, &ry
));
275 printf(" (order-1)*P (ECPoint_mul):\n");
276 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
278 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
281 MP_CHECKOK(ec_GF2m_add(&ry
, &rx
, &ry
, group
->meth
));
282 if ((mp_cmp(&rx
, &gx
) != 0) || (mp_cmp(&ry
, &gy
) != 0)) {
283 printf(" Error: invalid result (expected (- base point)).\n");
288 #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
289 /* multiply base point by order and check for point at infinity */
290 MP_CHECKOK(ec_GF2m_pt_mul_aff
291 (&group
->order
, &group
->genx
, &group
->geny
, &rx
, &ry
,
294 printf(" (order)*P (affine):\n");
295 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
297 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
300 if (ec_GF2m_pt_is_inf_aff(&rx
, &ry
) != MP_YES
) {
301 printf(" Error: invalid result (expected point at infinity).\n");
307 /* multiply base point by order and check for point at infinity */
308 MP_CHECKOK(ec_GF2m_pt_mul_mont
309 (&group
->order
, &group
->genx
, &group
->geny
, &rx
, &ry
,
312 printf(" (order)*P (montgomery):\n");
313 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
315 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
318 if (ec_GF2m_pt_is_inf_aff(&rx
, &ry
) != MP_YES
) {
319 printf(" Error: invalid result (expected point at infinity).\n");
324 #ifdef ECL_ENABLE_GF2M_PROJ
325 /* multiply base point by order and check for point at infinity */
326 MP_CHECKOK(ec_GF2m_pt_mul_proj
327 (&group
->order
, &group
->genx
, &group
->geny
, &rx
, &ry
,
330 printf(" (order)*P (projective):\n");
331 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
333 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
336 if (ec_GF2m_pt_is_inf_aff(&rx
, &ry
) != MP_YES
) {
337 printf(" Error: invalid result (expected point at infinity).\n");
343 /* multiply base point by order and check for point at infinity */
344 MP_CHECKOK(ECPoint_mul(group
, &group
->order
, NULL
, NULL
, &rx
, &ry
));
346 printf(" (order)*P (ECPoint_mul):\n");
347 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
349 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
352 if (ec_GF2m_pt_is_inf_aff(&rx
, &ry
) != MP_YES
) {
353 printf(" Error: invalid result (expected point at infinity).\n");
358 /* multiply base point by order and check for point at infinity */
359 MP_CHECKOK(ECPoint_mul(group
, &group
->order
, &gx
, &gy
, &rx
, &ry
));
361 printf(" (order)*P (ECPoint_mul):\n");
362 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
364 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
367 if (ec_GF2m_pt_is_inf_aff(&rx
, &ry
) != MP_YES
) {
368 printf(" Error: invalid result (expected point at infinity).\n");
373 /* check that (order-1)P + (order-1)P + P == (order-1)P */
374 MP_CHECKOK(ECPoints_mul
375 (group
, &order_1
, &order_1
, &gx
, &gy
, &rx
, &ry
));
376 MP_CHECKOK(ECPoints_mul(group
, &one
, &one
, &rx
, &ry
, &rx
, &ry
));
379 (" (order-1)*P + (order-1)*P + P == (order-1)*P (ECPoints_mul):\n");
380 MP_CHECKOK(mp_toradix(&rx
, s
, 16));
382 MP_CHECKOK(mp_toradix(&ry
, s
, 16));
385 MP_CHECKOK(ec_GF2m_add(&ry
, &rx
, &ry
, group
->meth
));
386 if ((mp_cmp(&rx
, &gx
) != 0) || (mp_cmp(&ry
, &gy
) != 0)) {
387 printf(" Error: invalid result (expected (- base point)).\n");
392 /* test validate_point function */
393 if (ECPoint_validate(group
, &gx
, &gy
) != MP_YES
) {
394 printf(" Error: validate point on base point failed.\n");
398 MP_CHECKOK(mp_add_d(&gy
, 1, &ry
));
399 if (ECPoint_validate(group
, &gx
, &ry
) != MP_NO
) {
400 printf(" Error: validate point on invalid point passed.\n");
406 /* compute random scalar */
407 size
= mpl_significant_bits(&group
->meth
->irr
);
408 if (size
< MP_OKAY
) {
411 MP_CHECKOK(mpp_random_size(&n
, (size
+ ECL_BITS
- 1) / ECL_BITS
));
412 MP_CHECKOK(group
->meth
->field_mod(&n
, &n
, group
->meth
));
415 #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
416 M_TimeOperation(MP_CHECKOK
418 (&n
, &group
->genx
, &group
->geny
, &rx
, &ry
,
421 M_TimeOperation(MP_CHECKOK
422 (ECPoint_mul(group
, &n
, NULL
, NULL
, &rx
, &ry
)),
424 M_TimeOperation(MP_CHECKOK
426 (group
, &n
, &n
, &gx
, &gy
, &rx
, &ry
)), 100);
428 M_TimeOperation(MP_CHECKOK
429 (ECPoint_mul(group
, &n
, NULL
, NULL
, &rx
, &ry
)),
431 M_TimeOperation(MP_CHECKOK
432 (ECPoint_mul(group
, &n
, &gx
, &gy
, &rx
, &ry
)),
434 M_TimeOperation(MP_CHECKOK
436 (group
, &n
, &n
, &gx
, &gy
, &rx
, &ry
)), 100);
448 if (res
!= MP_OKAY
) {
450 printf(" Error: exiting with error value 0x%x\n", res
);
452 printf(" Error: exiting with error value %i\n", res
);
458 /* Performs tests of elliptic curve cryptography over binary polynomial
459 * fields. If tests fail, then it prints an error message, aborts, and
460 * returns an error code. Otherwise, returns 0. */
467 ECGroup
*group
= NULL
;
468 ECCurveParams
*params
= NULL
;
471 /* generic arithmetic tests */
472 ECTEST_GENERIC_GF2M("SECT-131R1", ECCurve_SECG_CHAR2_131R1
);
474 /* specific arithmetic tests */
475 ECTEST_NAMED_GF2M("NIST-K163", ECCurve_NIST_K163
);
476 ECTEST_NAMED_GF2M("NIST-B163", ECCurve_NIST_B163
);
477 ECTEST_NAMED_GF2M("NIST-K233", ECCurve_NIST_K233
);
478 ECTEST_NAMED_GF2M("NIST-B233", ECCurve_NIST_B233
);
479 ECTEST_NAMED_GF2M("NIST-K283", ECCurve_NIST_K283
);
480 ECTEST_NAMED_GF2M("NIST-B283", ECCurve_NIST_B283
);
481 ECTEST_NAMED_GF2M("NIST-K409", ECCurve_NIST_K409
);
482 ECTEST_NAMED_GF2M("NIST-B409", ECCurve_NIST_B409
);
483 ECTEST_NAMED_GF2M("NIST-K571", ECCurve_NIST_K571
);
484 ECTEST_NAMED_GF2M("NIST-B571", ECCurve_NIST_B571
);
485 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V1", ECCurve_X9_62_CHAR2_PNB163V1
);
486 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V2", ECCurve_X9_62_CHAR2_PNB163V2
);
487 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB163V3", ECCurve_X9_62_CHAR2_PNB163V3
);
488 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB176V1", ECCurve_X9_62_CHAR2_PNB176V1
);
489 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V1", ECCurve_X9_62_CHAR2_TNB191V1
);
490 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V2", ECCurve_X9_62_CHAR2_TNB191V2
);
491 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB191V3", ECCurve_X9_62_CHAR2_TNB191V3
);
492 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB208W1", ECCurve_X9_62_CHAR2_PNB208W1
);
493 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V1", ECCurve_X9_62_CHAR2_TNB239V1
);
494 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V2", ECCurve_X9_62_CHAR2_TNB239V2
);
495 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB239V3", ECCurve_X9_62_CHAR2_TNB239V3
);
496 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB272W1", ECCurve_X9_62_CHAR2_PNB272W1
);
497 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB304W1", ECCurve_X9_62_CHAR2_PNB304W1
);
498 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB359V1", ECCurve_X9_62_CHAR2_TNB359V1
);
499 ECTEST_NAMED_GF2M("ANSI X9.62 C2PNB368W1", ECCurve_X9_62_CHAR2_PNB368W1
);
500 ECTEST_NAMED_GF2M("ANSI X9.62 C2TNB431R1", ECCurve_X9_62_CHAR2_TNB431R1
);
501 ECTEST_NAMED_GF2M("SECT-113R1", ECCurve_SECG_CHAR2_113R1
);
502 ECTEST_NAMED_GF2M("SECT-113R2", ECCurve_SECG_CHAR2_113R2
);
503 ECTEST_NAMED_GF2M("SECT-131R1", ECCurve_SECG_CHAR2_131R1
);
504 ECTEST_NAMED_GF2M("SECT-131R2", ECCurve_SECG_CHAR2_131R2
);
505 ECTEST_NAMED_GF2M("SECT-163K1", ECCurve_SECG_CHAR2_163K1
);
506 ECTEST_NAMED_GF2M("SECT-163R1", ECCurve_SECG_CHAR2_163R1
);
507 ECTEST_NAMED_GF2M("SECT-163R2", ECCurve_SECG_CHAR2_163R2
);
508 ECTEST_NAMED_GF2M("SECT-193R1", ECCurve_SECG_CHAR2_193R1
);
509 ECTEST_NAMED_GF2M("SECT-193R2", ECCurve_SECG_CHAR2_193R2
);
510 ECTEST_NAMED_GF2M("SECT-233K1", ECCurve_SECG_CHAR2_233K1
);
511 ECTEST_NAMED_GF2M("SECT-233R1", ECCurve_SECG_CHAR2_233R1
);
512 ECTEST_NAMED_GF2M("SECT-239K1", ECCurve_SECG_CHAR2_239K1
);
513 ECTEST_NAMED_GF2M("SECT-283K1", ECCurve_SECG_CHAR2_283K1
);
514 ECTEST_NAMED_GF2M("SECT-283R1", ECCurve_SECG_CHAR2_283R1
);
515 ECTEST_NAMED_GF2M("SECT-409K1", ECCurve_SECG_CHAR2_409K1
);
516 ECTEST_NAMED_GF2M("SECT-409R1", ECCurve_SECG_CHAR2_409R1
);
517 ECTEST_NAMED_GF2M("SECT-571K1", ECCurve_SECG_CHAR2_571K1
);
518 ECTEST_NAMED_GF2M("SECT-571R1", ECCurve_SECG_CHAR2_571R1
);
519 ECTEST_NAMED_GF2M("WTLS-1 (113)", ECCurve_WTLS_1
);
520 ECTEST_NAMED_GF2M("WTLS-3 (163)", ECCurve_WTLS_3
);
521 ECTEST_NAMED_GF2M("WTLS-4 (113)", ECCurve_WTLS_4
);
522 ECTEST_NAMED_GF2M("WTLS-5 (163)", ECCurve_WTLS_5
);
523 ECTEST_NAMED_GF2M("WTLS-10 (233)", ECCurve_WTLS_10
);
524 ECTEST_NAMED_GF2M("WTLS-11 (233)", ECCurve_WTLS_11
);
527 EC_FreeCurveParams(params
);
529 if (res
!= MP_OKAY
) {
531 printf("Error: exiting with error value 0x%x\n", res
);
533 printf("Error: exiting with error value %i\n", res
);