The ECP group structure.
We consider two types of curve equations:
-
Short Weierstrass:
y^2 = x^3 + A x + B mod P (SEC1 + RFC-4492)
-
Montgomery:
y^2 = x^3 + A x^2 + x mod P (Curve25519, Curve448)
In both cases, the generator (G) for a prime-order subgroup is fixed.
For Short Weierstrass, this subgroup is the whole curve, and its cardinality is denoted by N. Our code requires that N is an odd prime as mbedtls_ecp_mul() requires an odd number, and mbedtls_ecdsa_sign() requires that it is prime for blinding purposes.
The default implementation only initializes A without setting it to the authentic value for curves with A = -3(SECP256R1, etc), in which case you need to load A by yourself when using domain parameters directly, for example:
} else {
}
cleanup:
int mbedtls_mpi_sub_int(mbedtls_mpi *X, const mbedtls_mpi *A, mbedtls_mpi_sint b)
Perform a signed subtraction of an MPI and an integer: X = A - b.
int mbedtls_mpi_copy(mbedtls_mpi *X, const mbedtls_mpi *Y)
Make a copy of an MPI.
void mbedtls_mpi_init(mbedtls_mpi *X)
Initialize an MPI context.
void mbedtls_mpi_free(mbedtls_mpi *X)
This function frees the components of an MPI context.
void mbedtls_ecp_group_init(mbedtls_ecp_group *grp)
This function initializes an ECP group context without loading any domain parameters.
int mbedtls_ecp_group_load(mbedtls_ecp_group *grp, mbedtls_ecp_group_id id)
This function sets up an ECP group context from a standardized set of domain parameters.
void mbedtls_ecp_group_free(mbedtls_ecp_group *grp)
This function frees the components of an ECP group.
static int mbedtls_ecp_group_a_is_minus_3(const mbedtls_ecp_group *grp)
This function checks if domain parameter A of the curve is -3.
For Montgomery curves, we do not store A, but (A + 2) / 4, which is the quantity used in the formulas. Additionally, nbits is not the size of N but the required size for private keys.
If modp is NULL, reduction modulo P is done using a generic algorithm. Otherwise, modp must point to a function that takes an mbedtls_mpi in the range of [0, 2^(2*pbits)), and transforms it in-place to an integer which is congruent mod P to the given MPI, is in the range [0, 2P), and has no more non-zero limbs than P, so that it may be efficiently brought into the range [0, P) by a single constant-time conditional subtraction. It must return 0 on success and non-zero on failure.
Definition at line 222 of file ecp.h.
1.13.2