github.com/AESNooper/go/src@v0.0.0-20220218095104-b56a4ab1bbbb/crypto/elliptic/p384.go (about) 1 // Copyright 2013 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package elliptic 6 7 import ( 8 "crypto/elliptic/internal/nistec" 9 "crypto/rand" 10 "math/big" 11 ) 12 13 // p384Curve is a Curve implementation based on nistec.P384Point. 14 // 15 // It's a wrapper that exposes the big.Int-based Curve interface and encodes the 16 // legacy idiosyncrasies it requires, such as invalid and infinity point 17 // handling. 18 // 19 // To interact with the nistec package, points are encoded into and decoded from 20 // properly formatted byte slices. All big.Int use is limited to this package. 21 // Encoding and decoding is 1/1000th of the runtime of a scalar multiplication, 22 // so the overhead is acceptable. 23 type p384Curve struct { 24 params *CurveParams 25 } 26 27 var p384 p384Curve 28 var _ Curve = p384 29 30 func initP384() { 31 p384.params = &CurveParams{ 32 Name: "P-384", 33 BitSize: 384, 34 // FIPS 186-4, section D.1.2.4 35 P: bigFromDecimal("394020061963944792122790401001436138050797392704654" + 36 "46667948293404245721771496870329047266088258938001861606973112319"), 37 N: bigFromDecimal("394020061963944792122790401001436138050797392704654" + 38 "46667946905279627659399113263569398956308152294913554433653942643"), 39 B: bigFromHex("b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088" + 40 "f5013875ac656398d8a2ed19d2a85c8edd3ec2aef"), 41 Gx: bigFromHex("aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741" + 42 "e082542a385502f25dbf55296c3a545e3872760ab7"), 43 Gy: bigFromHex("3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da31" + 44 "13b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f"), 45 } 46 } 47 48 func (curve p384Curve) Params() *CurveParams { 49 return curve.params 50 } 51 52 func (curve p384Curve) IsOnCurve(x, y *big.Int) bool { 53 // IsOnCurve is documented to reject (0, 0), the conventional point at 54 // infinity, which however is accepted by p384PointFromAffine. 55 if x.Sign() == 0 && y.Sign() == 0 { 56 return false 57 } 58 _, ok := p384PointFromAffine(x, y) 59 return ok 60 } 61 62 func p384PointFromAffine(x, y *big.Int) (p *nistec.P384Point, ok bool) { 63 // (0, 0) is by convention the point at infinity, which can't be represented 64 // in affine coordinates. Marshal incorrectly encodes it as an uncompressed 65 // point, which SetBytes would correctly reject. See Issue 37294. 66 if x.Sign() == 0 && y.Sign() == 0 { 67 return nistec.NewP384Point(), true 68 } 69 if x.BitLen() > 384 || y.BitLen() > 384 { 70 return nil, false 71 } 72 p, err := nistec.NewP384Point().SetBytes(Marshal(P384(), x, y)) 73 if err != nil { 74 return nil, false 75 } 76 return p, true 77 } 78 79 func p384PointToAffine(p *nistec.P384Point) (x, y *big.Int) { 80 out := p.Bytes() 81 if len(out) == 1 && out[0] == 0 { 82 // This is the correct encoding of the point at infinity, which 83 // Unmarshal does not support. See Issue 37294. 84 return new(big.Int), new(big.Int) 85 } 86 x, y = Unmarshal(P384(), out) 87 if x == nil { 88 panic("crypto/elliptic: internal error: Unmarshal rejected a valid point encoding") 89 } 90 return x, y 91 } 92 93 // p384RandomPoint returns a random point on the curve. It's used when Add, 94 // Double, or ScalarMult are fed a point not on the curve, which is undefined 95 // behavior. Originally, we used to do the math on it anyway (which allows 96 // invalid curve attacks) and relied on the caller and Unmarshal to avoid this 97 // happening in the first place. Now, we just can't construct a nistec.P384Point 98 // for an invalid pair of coordinates, because that API is safer. If we panic, 99 // we risk introducing a DoS. If we return nil, we risk a panic. If we return 100 // the input, ecdsa.Verify might fail open. The safest course seems to be to 101 // return a valid, random point, which hopefully won't help the attacker. 102 func p384RandomPoint() (x, y *big.Int) { 103 _, x, y, err := GenerateKey(P384(), rand.Reader) 104 if err != nil { 105 panic("crypto/elliptic: failed to generate random point") 106 } 107 return x, y 108 } 109 110 func (p384Curve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) { 111 p1, ok := p384PointFromAffine(x1, y1) 112 if !ok { 113 return p384RandomPoint() 114 } 115 p2, ok := p384PointFromAffine(x2, y2) 116 if !ok { 117 return p384RandomPoint() 118 } 119 return p384PointToAffine(p1.Add(p1, p2)) 120 } 121 122 func (p384Curve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) { 123 p, ok := p384PointFromAffine(x1, y1) 124 if !ok { 125 return p384RandomPoint() 126 } 127 return p384PointToAffine(p.Double(p)) 128 } 129 130 func (p384Curve) ScalarMult(Bx, By *big.Int, scalar []byte) (*big.Int, *big.Int) { 131 p, ok := p384PointFromAffine(Bx, By) 132 if !ok { 133 return p384RandomPoint() 134 } 135 return p384PointToAffine(p.ScalarMult(p, scalar)) 136 } 137 138 func (p384Curve) ScalarBaseMult(scalar []byte) (*big.Int, *big.Int) { 139 p := nistec.NewP384Generator() 140 return p384PointToAffine(p.ScalarMult(p, scalar)) 141 }