The ECP group structure.
We consider two types of curve equations:
-
Short Weierstrass:
y^2 = x^3 + A x + B mod P
(SEC1 + RFC-4492)
-
Montgomery:
y^2 = x^3 + A x^2 + x mod P
(Curve25519, Curve448)
In both cases, the generator (G
) for a prime-order subgroup is fixed.
For Short Weierstrass, this subgroup is the whole curve, and its cardinality is denoted by N
. Our code requires that N
is an odd prime as mbedtls_ecp_mul() requires an odd number, and mbedtls_ecdsa_sign() requires that it is prime for blinding purposes.
The default implementation only initializes A
without setting it to the authentic value for curves with A = -3
(SECP256R1, etc), in which case you need to load A
by yourself when using domain parameters directly, for example:
} else {
}
cleanup:
int mbedtls_mpi_sub_int(mbedtls_mpi *X, const mbedtls_mpi *A, mbedtls_mpi_sint b)
Perform a signed subtraction of an MPI and an integer: X = A - b.
int mbedtls_mpi_copy(mbedtls_mpi *X, const mbedtls_mpi *Y)
Make a copy of an MPI.
void mbedtls_mpi_init(mbedtls_mpi *X)
Initialize an MPI context.
void mbedtls_mpi_free(mbedtls_mpi *X)
This function frees the components of an MPI context.
void mbedtls_ecp_group_init(mbedtls_ecp_group *grp)
This function initializes an ECP group context without loading any domain parameters.
int mbedtls_ecp_group_load(mbedtls_ecp_group *grp, mbedtls_ecp_group_id id)
This function sets up an ECP group context from a standardized set of domain parameters.
void mbedtls_ecp_group_free(mbedtls_ecp_group *grp)
This function frees the components of an ECP group.
static int mbedtls_ecp_group_a_is_minus_3(const mbedtls_ecp_group *grp)
This function checks if domain parameter A of the curve is -3.
For Montgomery curves, we do not store A
, but (A + 2) / 4
, which is the quantity used in the formulas. Additionally, nbits
is not the size of N
but the required size for private keys.
If modp
is NULL, reduction modulo P
is done using a generic algorithm. Otherwise, modp
must point to a function that takes an mbedtls_mpi
in the range of 0..2^(2*pbits)-1
, and transforms it in-place to an integer which is congruent mod P
to the given MPI, and is close enough to pbits
in size, so that it may be efficiently brought in the 0..P-1 range by a few additions or subtractions. Therefore, it is only an approximate modular reduction. It must return 0 on success and non-zero on failure.
- Note
- Alternative implementations must keep the group IDs distinct. If two group structures have the same ID, then they must be identical.
Definition at line 270 of file ecp.h.