1*c40a6cd7SToomas Soome /*
2f9fbec18Smcpowers * ***** BEGIN LICENSE BLOCK *****
3f9fbec18Smcpowers * Version: MPL 1.1/GPL 2.0/LGPL 2.1
4f9fbec18Smcpowers *
5f9fbec18Smcpowers * The contents of this file are subject to the Mozilla Public License Version
6f9fbec18Smcpowers * 1.1 (the "License"); you may not use this file except in compliance with
7f9fbec18Smcpowers * the License. You may obtain a copy of the License at
8f9fbec18Smcpowers * http://www.mozilla.org/MPL/
9f9fbec18Smcpowers *
10f9fbec18Smcpowers * Software distributed under the License is distributed on an "AS IS" basis,
11f9fbec18Smcpowers * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
12f9fbec18Smcpowers * for the specific language governing rights and limitations under the
13f9fbec18Smcpowers * License.
14f9fbec18Smcpowers *
15f9fbec18Smcpowers * The Original Code is the elliptic curve math library.
16f9fbec18Smcpowers *
17f9fbec18Smcpowers * The Initial Developer of the Original Code is
18f9fbec18Smcpowers * Sun Microsystems, Inc.
19f9fbec18Smcpowers * Portions created by the Initial Developer are Copyright (C) 2003
20f9fbec18Smcpowers * the Initial Developer. All Rights Reserved.
21f9fbec18Smcpowers *
22f9fbec18Smcpowers * Contributor(s):
23f9fbec18Smcpowers * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories
24f9fbec18Smcpowers *
25f9fbec18Smcpowers * Alternatively, the contents of this file may be used under the terms of
26f9fbec18Smcpowers * either the GNU General Public License Version 2 or later (the "GPL"), or
27f9fbec18Smcpowers * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
28f9fbec18Smcpowers * in which case the provisions of the GPL or the LGPL are applicable instead
29f9fbec18Smcpowers * of those above. If you wish to allow use of your version of this file only
30f9fbec18Smcpowers * under the terms of either the GPL or the LGPL, and not to allow others to
31f9fbec18Smcpowers * use your version of this file under the terms of the MPL, indicate your
32f9fbec18Smcpowers * decision by deleting the provisions above and replace them with the notice
33f9fbec18Smcpowers * and other provisions required by the GPL or the LGPL. If you do not delete
34f9fbec18Smcpowers * the provisions above, a recipient may use your version of this file under
35f9fbec18Smcpowers * the terms of any one of the MPL, the GPL or the LGPL.
36f9fbec18Smcpowers *
37f9fbec18Smcpowers * ***** END LICENSE BLOCK ***** */
38f9fbec18Smcpowers /*
39f9fbec18Smcpowers * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
40f9fbec18Smcpowers * Use is subject to license terms.
41f9fbec18Smcpowers *
42f9fbec18Smcpowers * Sun elects to use this software under the MPL license.
43f9fbec18Smcpowers */
44f9fbec18Smcpowers
45f9fbec18Smcpowers #include "mpi.h"
46f9fbec18Smcpowers #include "mplogic.h"
47f9fbec18Smcpowers #include "ecl.h"
48f9fbec18Smcpowers #include "ecl-priv.h"
49f9fbec18Smcpowers #ifndef _KERNEL
50f9fbec18Smcpowers #include <stdlib.h>
51f9fbec18Smcpowers #endif
52f9fbec18Smcpowers
53*c40a6cd7SToomas Soome /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k * P(x,
54*c40a6cd7SToomas Soome * y). If x, y = NULL, then P is assumed to be the generator (base point)
55f9fbec18Smcpowers * of the group of points on the elliptic curve. Input and output values
56f9fbec18Smcpowers * are assumed to be NOT field-encoded. */
57f9fbec18Smcpowers mp_err
ECPoint_mul(const ECGroup * group,const mp_int * k,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry)58f9fbec18Smcpowers ECPoint_mul(const ECGroup *group, const mp_int *k, const mp_int *px,
59f9fbec18Smcpowers const mp_int *py, mp_int *rx, mp_int *ry)
60f9fbec18Smcpowers {
61f9fbec18Smcpowers mp_err res = MP_OKAY;
62f9fbec18Smcpowers mp_int kt;
63f9fbec18Smcpowers
64f9fbec18Smcpowers ARGCHK((k != NULL) && (group != NULL), MP_BADARG);
65f9fbec18Smcpowers MP_DIGITS(&kt) = 0;
66f9fbec18Smcpowers
67f9fbec18Smcpowers /* want scalar to be less than or equal to group order */
68f9fbec18Smcpowers if (mp_cmp(k, &group->order) > 0) {
69f9fbec18Smcpowers MP_CHECKOK(mp_init(&kt, FLAG(k)));
70f9fbec18Smcpowers MP_CHECKOK(mp_mod(k, &group->order, &kt));
71f9fbec18Smcpowers } else {
72f9fbec18Smcpowers MP_SIGN(&kt) = MP_ZPOS;
73f9fbec18Smcpowers MP_USED(&kt) = MP_USED(k);
74f9fbec18Smcpowers MP_ALLOC(&kt) = MP_ALLOC(k);
75f9fbec18Smcpowers MP_DIGITS(&kt) = MP_DIGITS(k);
76f9fbec18Smcpowers }
77f9fbec18Smcpowers
78f9fbec18Smcpowers if ((px == NULL) || (py == NULL)) {
79f9fbec18Smcpowers if (group->base_point_mul) {
80f9fbec18Smcpowers MP_CHECKOK(group->base_point_mul(&kt, rx, ry, group));
81f9fbec18Smcpowers } else {
82f9fbec18Smcpowers MP_CHECKOK(group->
83f9fbec18Smcpowers point_mul(&kt, &group->genx, &group->geny, rx, ry,
84f9fbec18Smcpowers group));
85f9fbec18Smcpowers }
86f9fbec18Smcpowers } else {
87f9fbec18Smcpowers if (group->meth->field_enc) {
88f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(px, rx, group->meth));
89f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(py, ry, group->meth));
90f9fbec18Smcpowers MP_CHECKOK(group->point_mul(&kt, rx, ry, rx, ry, group));
91f9fbec18Smcpowers } else {
92f9fbec18Smcpowers MP_CHECKOK(group->point_mul(&kt, px, py, rx, ry, group));
93f9fbec18Smcpowers }
94f9fbec18Smcpowers }
95f9fbec18Smcpowers if (group->meth->field_dec) {
96f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth));
97f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth));
98f9fbec18Smcpowers }
99f9fbec18Smcpowers
100f9fbec18Smcpowers CLEANUP:
101f9fbec18Smcpowers if (MP_DIGITS(&kt) != MP_DIGITS(k)) {
102f9fbec18Smcpowers mp_clear(&kt);
103f9fbec18Smcpowers }
104f9fbec18Smcpowers return res;
105f9fbec18Smcpowers }
106f9fbec18Smcpowers
107*c40a6cd7SToomas Soome /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G +
108f9fbec18Smcpowers * k2 * P(x, y), where G is the generator (base point) of the group of
109f9fbec18Smcpowers * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL.
110f9fbec18Smcpowers * Input and output values are assumed to be NOT field-encoded. */
111f9fbec18Smcpowers mp_err
ec_pts_mul_basic(const mp_int * k1,const mp_int * k2,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry,const ECGroup * group)112f9fbec18Smcpowers ec_pts_mul_basic(const mp_int *k1, const mp_int *k2, const mp_int *px,
113f9fbec18Smcpowers const mp_int *py, mp_int *rx, mp_int *ry,
114f9fbec18Smcpowers const ECGroup *group)
115f9fbec18Smcpowers {
116f9fbec18Smcpowers mp_err res = MP_OKAY;
117f9fbec18Smcpowers mp_int sx, sy;
118f9fbec18Smcpowers
119f9fbec18Smcpowers ARGCHK(group != NULL, MP_BADARG);
120f9fbec18Smcpowers ARGCHK(!((k1 == NULL)
121f9fbec18Smcpowers && ((k2 == NULL) || (px == NULL)
122f9fbec18Smcpowers || (py == NULL))), MP_BADARG);
123f9fbec18Smcpowers
124f9fbec18Smcpowers /* if some arguments are not defined used ECPoint_mul */
125f9fbec18Smcpowers if (k1 == NULL) {
126f9fbec18Smcpowers return ECPoint_mul(group, k2, px, py, rx, ry);
127f9fbec18Smcpowers } else if ((k2 == NULL) || (px == NULL) || (py == NULL)) {
128f9fbec18Smcpowers return ECPoint_mul(group, k1, NULL, NULL, rx, ry);
129f9fbec18Smcpowers }
130f9fbec18Smcpowers
131f9fbec18Smcpowers MP_DIGITS(&sx) = 0;
132f9fbec18Smcpowers MP_DIGITS(&sy) = 0;
133f9fbec18Smcpowers MP_CHECKOK(mp_init(&sx, FLAG(k1)));
134f9fbec18Smcpowers MP_CHECKOK(mp_init(&sy, FLAG(k1)));
135f9fbec18Smcpowers
136f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, k1, NULL, NULL, &sx, &sy));
137f9fbec18Smcpowers MP_CHECKOK(ECPoint_mul(group, k2, px, py, rx, ry));
138f9fbec18Smcpowers
139f9fbec18Smcpowers if (group->meth->field_enc) {
140f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(&sx, &sx, group->meth));
141f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(&sy, &sy, group->meth));
142f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(rx, rx, group->meth));
143f9fbec18Smcpowers MP_CHECKOK(group->meth->field_enc(ry, ry, group->meth));
144f9fbec18Smcpowers }
145f9fbec18Smcpowers
146f9fbec18Smcpowers MP_CHECKOK(group->point_add(&sx, &sy, rx, ry, rx, ry, group));
147f9fbec18Smcpowers
148f9fbec18Smcpowers if (group->meth->field_dec) {
149f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth));
150f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth));
151f9fbec18Smcpowers }
152f9fbec18Smcpowers
153f9fbec18Smcpowers CLEANUP:
154f9fbec18Smcpowers mp_clear(&sx);
155f9fbec18Smcpowers mp_clear(&sy);
156f9fbec18Smcpowers return res;
157f9fbec18Smcpowers }
158f9fbec18Smcpowers
159*c40a6cd7SToomas Soome /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G +
160f9fbec18Smcpowers * k2 * P(x, y), where G is the generator (base point) of the group of
161f9fbec18Smcpowers * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL.
162f9fbec18Smcpowers * Input and output values are assumed to be NOT field-encoded. Uses
163f9fbec18Smcpowers * algorithm 15 (simultaneous multiple point multiplication) from Brown,
164f9fbec18Smcpowers * Hankerson, Lopez, Menezes. Software Implementation of the NIST
165f9fbec18Smcpowers * Elliptic Curves over Prime Fields. */
166f9fbec18Smcpowers mp_err
ec_pts_mul_simul_w2(const mp_int * k1,const mp_int * k2,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry,const ECGroup * group)167f9fbec18Smcpowers ec_pts_mul_simul_w2(const mp_int *k1, const mp_int *k2, const mp_int *px,
168f9fbec18Smcpowers const mp_int *py, mp_int *rx, mp_int *ry,
169f9fbec18Smcpowers const ECGroup *group)
170f9fbec18Smcpowers {
171f9fbec18Smcpowers mp_err res = MP_OKAY;
172f9fbec18Smcpowers mp_int precomp[4][4][2];
173f9fbec18Smcpowers const mp_int *a, *b;
174f9fbec18Smcpowers int i, j;
175f9fbec18Smcpowers int ai, bi, d;
176f9fbec18Smcpowers
177f9fbec18Smcpowers ARGCHK(group != NULL, MP_BADARG);
178f9fbec18Smcpowers ARGCHK(!((k1 == NULL)
179f9fbec18Smcpowers && ((k2 == NULL) || (px == NULL)
180f9fbec18Smcpowers || (py == NULL))), MP_BADARG);
181f9fbec18Smcpowers
182f9fbec18Smcpowers /* if some arguments are not defined used ECPoint_mul */
183f9fbec18Smcpowers if (k1 == NULL) {
184f9fbec18Smcpowers return ECPoint_mul(group, k2, px, py, rx, ry);
185f9fbec18Smcpowers } else if ((k2 == NULL) || (px == NULL) || (py == NULL)) {
186f9fbec18Smcpowers return ECPoint_mul(group, k1, NULL, NULL, rx, ry);
187f9fbec18Smcpowers }
188f9fbec18Smcpowers
189f9fbec18Smcpowers /* initialize precomputation table */
190f9fbec18Smcpowers for (i = 0; i < 4; i++) {
191f9fbec18Smcpowers for (j = 0; j < 4; j++) {
192f9fbec18Smcpowers MP_DIGITS(&precomp[i][j][0]) = 0;
193f9fbec18Smcpowers MP_DIGITS(&precomp[i][j][1]) = 0;
194f9fbec18Smcpowers }
195f9fbec18Smcpowers }
196f9fbec18Smcpowers for (i = 0; i < 4; i++) {
197f9fbec18Smcpowers for (j = 0; j < 4; j++) {
198f9fbec18Smcpowers MP_CHECKOK( mp_init_size(&precomp[i][j][0],
199f9fbec18Smcpowers ECL_MAX_FIELD_SIZE_DIGITS, FLAG(k1)) );
200f9fbec18Smcpowers MP_CHECKOK( mp_init_size(&precomp[i][j][1],
201f9fbec18Smcpowers ECL_MAX_FIELD_SIZE_DIGITS, FLAG(k1)) );
202f9fbec18Smcpowers }
203f9fbec18Smcpowers }
204f9fbec18Smcpowers
205f9fbec18Smcpowers /* fill precomputation table */
206f9fbec18Smcpowers /* assign {k1, k2} = {a, b} such that len(a) >= len(b) */
207f9fbec18Smcpowers if (mpl_significant_bits(k1) < mpl_significant_bits(k2)) {
208f9fbec18Smcpowers a = k2;
209f9fbec18Smcpowers b = k1;
210f9fbec18Smcpowers if (group->meth->field_enc) {
211f9fbec18Smcpowers MP_CHECKOK(group->meth->
212f9fbec18Smcpowers field_enc(px, &precomp[1][0][0], group->meth));
213f9fbec18Smcpowers MP_CHECKOK(group->meth->
214f9fbec18Smcpowers field_enc(py, &precomp[1][0][1], group->meth));
215f9fbec18Smcpowers } else {
216f9fbec18Smcpowers MP_CHECKOK(mp_copy(px, &precomp[1][0][0]));
217f9fbec18Smcpowers MP_CHECKOK(mp_copy(py, &precomp[1][0][1]));
218f9fbec18Smcpowers }
219f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->genx, &precomp[0][1][0]));
220f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->geny, &precomp[0][1][1]));
221f9fbec18Smcpowers } else {
222f9fbec18Smcpowers a = k1;
223f9fbec18Smcpowers b = k2;
224f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->genx, &precomp[1][0][0]));
225f9fbec18Smcpowers MP_CHECKOK(mp_copy(&group->geny, &precomp[1][0][1]));
226f9fbec18Smcpowers if (group->meth->field_enc) {
227f9fbec18Smcpowers MP_CHECKOK(group->meth->
228f9fbec18Smcpowers field_enc(px, &precomp[0][1][0], group->meth));
229f9fbec18Smcpowers MP_CHECKOK(group->meth->
230f9fbec18Smcpowers field_enc(py, &precomp[0][1][1], group->meth));
231f9fbec18Smcpowers } else {
232f9fbec18Smcpowers MP_CHECKOK(mp_copy(px, &precomp[0][1][0]));
233f9fbec18Smcpowers MP_CHECKOK(mp_copy(py, &precomp[0][1][1]));
234f9fbec18Smcpowers }
235f9fbec18Smcpowers }
236f9fbec18Smcpowers /* precompute [*][0][*] */
237f9fbec18Smcpowers mp_zero(&precomp[0][0][0]);
238f9fbec18Smcpowers mp_zero(&precomp[0][0][1]);
239f9fbec18Smcpowers MP_CHECKOK(group->
240f9fbec18Smcpowers point_dbl(&precomp[1][0][0], &precomp[1][0][1],
241f9fbec18Smcpowers &precomp[2][0][0], &precomp[2][0][1], group));
242f9fbec18Smcpowers MP_CHECKOK(group->
243f9fbec18Smcpowers point_add(&precomp[1][0][0], &precomp[1][0][1],
244f9fbec18Smcpowers &precomp[2][0][0], &precomp[2][0][1],
245f9fbec18Smcpowers &precomp[3][0][0], &precomp[3][0][1], group));
246f9fbec18Smcpowers /* precompute [*][1][*] */
247f9fbec18Smcpowers for (i = 1; i < 4; i++) {
248f9fbec18Smcpowers MP_CHECKOK(group->
249f9fbec18Smcpowers point_add(&precomp[0][1][0], &precomp[0][1][1],
250f9fbec18Smcpowers &precomp[i][0][0], &precomp[i][0][1],
251f9fbec18Smcpowers &precomp[i][1][0], &precomp[i][1][1], group));
252f9fbec18Smcpowers }
253f9fbec18Smcpowers /* precompute [*][2][*] */
254f9fbec18Smcpowers MP_CHECKOK(group->
255f9fbec18Smcpowers point_dbl(&precomp[0][1][0], &precomp[0][1][1],
256f9fbec18Smcpowers &precomp[0][2][0], &precomp[0][2][1], group));
257f9fbec18Smcpowers for (i = 1; i < 4; i++) {
258f9fbec18Smcpowers MP_CHECKOK(group->
259f9fbec18Smcpowers point_add(&precomp[0][2][0], &precomp[0][2][1],
260f9fbec18Smcpowers &precomp[i][0][0], &precomp[i][0][1],
261f9fbec18Smcpowers &precomp[i][2][0], &precomp[i][2][1], group));
262f9fbec18Smcpowers }
263f9fbec18Smcpowers /* precompute [*][3][*] */
264f9fbec18Smcpowers MP_CHECKOK(group->
265f9fbec18Smcpowers point_add(&precomp[0][1][0], &precomp[0][1][1],
266f9fbec18Smcpowers &precomp[0][2][0], &precomp[0][2][1],
267f9fbec18Smcpowers &precomp[0][3][0], &precomp[0][3][1], group));
268f9fbec18Smcpowers for (i = 1; i < 4; i++) {
269f9fbec18Smcpowers MP_CHECKOK(group->
270f9fbec18Smcpowers point_add(&precomp[0][3][0], &precomp[0][3][1],
271f9fbec18Smcpowers &precomp[i][0][0], &precomp[i][0][1],
272f9fbec18Smcpowers &precomp[i][3][0], &precomp[i][3][1], group));
273f9fbec18Smcpowers }
274f9fbec18Smcpowers
275f9fbec18Smcpowers d = (mpl_significant_bits(a) + 1) / 2;
276f9fbec18Smcpowers
277f9fbec18Smcpowers /* R = inf */
278f9fbec18Smcpowers mp_zero(rx);
279f9fbec18Smcpowers mp_zero(ry);
280f9fbec18Smcpowers
281f9fbec18Smcpowers for (i = d - 1; i >= 0; i--) {
282f9fbec18Smcpowers ai = MP_GET_BIT(a, 2 * i + 1);
283f9fbec18Smcpowers ai <<= 1;
284f9fbec18Smcpowers ai |= MP_GET_BIT(a, 2 * i);
285f9fbec18Smcpowers bi = MP_GET_BIT(b, 2 * i + 1);
286f9fbec18Smcpowers bi <<= 1;
287f9fbec18Smcpowers bi |= MP_GET_BIT(b, 2 * i);
288f9fbec18Smcpowers /* R = 2^2 * R */
289f9fbec18Smcpowers MP_CHECKOK(group->point_dbl(rx, ry, rx, ry, group));
290f9fbec18Smcpowers MP_CHECKOK(group->point_dbl(rx, ry, rx, ry, group));
291f9fbec18Smcpowers /* R = R + (ai * A + bi * B) */
292f9fbec18Smcpowers MP_CHECKOK(group->
293f9fbec18Smcpowers point_add(rx, ry, &precomp[ai][bi][0],
294f9fbec18Smcpowers &precomp[ai][bi][1], rx, ry, group));
295f9fbec18Smcpowers }
296f9fbec18Smcpowers
297f9fbec18Smcpowers if (group->meth->field_dec) {
298f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(rx, rx, group->meth));
299f9fbec18Smcpowers MP_CHECKOK(group->meth->field_dec(ry, ry, group->meth));
300f9fbec18Smcpowers }
301f9fbec18Smcpowers
302f9fbec18Smcpowers CLEANUP:
303f9fbec18Smcpowers for (i = 0; i < 4; i++) {
304f9fbec18Smcpowers for (j = 0; j < 4; j++) {
305f9fbec18Smcpowers mp_clear(&precomp[i][j][0]);
306f9fbec18Smcpowers mp_clear(&precomp[i][j][1]);
307f9fbec18Smcpowers }
308f9fbec18Smcpowers }
309f9fbec18Smcpowers return res;
310f9fbec18Smcpowers }
311f9fbec18Smcpowers
312*c40a6cd7SToomas Soome /* Elliptic curve scalar-point multiplication. Computes R(x, y) = k1 * G +
313f9fbec18Smcpowers * k2 * P(x, y), where G is the generator (base point) of the group of
314f9fbec18Smcpowers * points on the elliptic curve. Allows k1 = NULL or { k2, P } = NULL.
315f9fbec18Smcpowers * Input and output values are assumed to be NOT field-encoded. */
316f9fbec18Smcpowers mp_err
ECPoints_mul(const ECGroup * group,const mp_int * k1,const mp_int * k2,const mp_int * px,const mp_int * py,mp_int * rx,mp_int * ry)317f9fbec18Smcpowers ECPoints_mul(const ECGroup *group, const mp_int *k1, const mp_int *k2,
318f9fbec18Smcpowers const mp_int *px, const mp_int *py, mp_int *rx, mp_int *ry)
319f9fbec18Smcpowers {
320f9fbec18Smcpowers mp_err res = MP_OKAY;
321f9fbec18Smcpowers mp_int k1t, k2t;
322f9fbec18Smcpowers const mp_int *k1p, *k2p;
323f9fbec18Smcpowers
324f9fbec18Smcpowers MP_DIGITS(&k1t) = 0;
325f9fbec18Smcpowers MP_DIGITS(&k2t) = 0;
326f9fbec18Smcpowers
327f9fbec18Smcpowers ARGCHK(group != NULL, MP_BADARG);
328f9fbec18Smcpowers
329f9fbec18Smcpowers /* want scalar to be less than or equal to group order */
330f9fbec18Smcpowers if (k1 != NULL) {
331f9fbec18Smcpowers if (mp_cmp(k1, &group->order) >= 0) {
332f9fbec18Smcpowers MP_CHECKOK(mp_init(&k1t, FLAG(k1)));
333f9fbec18Smcpowers MP_CHECKOK(mp_mod(k1, &group->order, &k1t));
334f9fbec18Smcpowers k1p = &k1t;
335f9fbec18Smcpowers } else {
336f9fbec18Smcpowers k1p = k1;
337f9fbec18Smcpowers }
338f9fbec18Smcpowers } else {
339f9fbec18Smcpowers k1p = k1;
340f9fbec18Smcpowers }
341f9fbec18Smcpowers if (k2 != NULL) {
342f9fbec18Smcpowers if (mp_cmp(k2, &group->order) >= 0) {
343f9fbec18Smcpowers MP_CHECKOK(mp_init(&k2t, FLAG(k2)));
344f9fbec18Smcpowers MP_CHECKOK(mp_mod(k2, &group->order, &k2t));
345f9fbec18Smcpowers k2p = &k2t;
346f9fbec18Smcpowers } else {
347f9fbec18Smcpowers k2p = k2;
348f9fbec18Smcpowers }
349f9fbec18Smcpowers } else {
350f9fbec18Smcpowers k2p = k2;
351f9fbec18Smcpowers }
352f9fbec18Smcpowers
353f9fbec18Smcpowers /* if points_mul is defined, then use it */
354f9fbec18Smcpowers if (group->points_mul) {
355f9fbec18Smcpowers res = group->points_mul(k1p, k2p, px, py, rx, ry, group);
356f9fbec18Smcpowers } else {
357f9fbec18Smcpowers res = ec_pts_mul_simul_w2(k1p, k2p, px, py, rx, ry, group);
358f9fbec18Smcpowers }
359f9fbec18Smcpowers
360f9fbec18Smcpowers CLEANUP:
361f9fbec18Smcpowers mp_clear(&k1t);
362f9fbec18Smcpowers mp_clear(&k2t);
363f9fbec18Smcpowers return res;
364f9fbec18Smcpowers }
365