Source code
Revision control
Copy as Markdown
Other Tools
/*
* (C) 2024 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include <botan/internal/ec_key_data.h>
#include <botan/mem_ops.h>
#include <botan/rng.h>
namespace Botan {
EC_PublicKey_Data::EC_PublicKey_Data(EC_Group group, EC_AffinePoint pt) :
m_group(std::move(group)), m_point(std::move(pt)) {
#if defined(BOTAN_HAS_LEGACY_EC_POINT)
m_legacy_point = m_point.to_legacy_point();
#endif
// Checking that the point lies on the curve is done in the deserialization
// of EC_AffinePoint.
BOTAN_ARG_CHECK(!m_point.is_identity(), "ECC public key cannot be point at infinity");
}
EC_PrivateKey_Data::EC_PrivateKey_Data(EC_Group group, EC_Scalar x) :
m_group(std::move(group)), m_scalar(std::move(x)), m_legacy_x(m_scalar.to_bigint()) {
// Checking that the scalar is lower than the group order is ensured in the
// deserialization of the EC_Scalar or during the random generation respectively.
BOTAN_ARG_CHECK(m_scalar.is_nonzero(), "ECC private key cannot be zero");
}
namespace {
EC_Scalar decode_ec_secret_key_scalar(const EC_Group& group, std::span<const uint8_t> bytes) {
const size_t order_bytes = group.get_order_bytes();
if(bytes.size() < order_bytes) {
/*
* Older versions had a bug which caused secret keys to not be encoded to
* the full byte length of the order if there were leading zero bytes. This
* was particularly a problem for P-521, where on average half of keys do
* not have their high bit set and so can be encoded in 65 bytes, vs 66
* bytes for the full order.
*
* To accomodate this, zero prefix the key if we see such a short input
*/
secure_vector<uint8_t> padded_sk(order_bytes);
copy_mem(std::span{padded_sk}.last(bytes.size()), bytes);
return decode_ec_secret_key_scalar(group, padded_sk);
}
if(auto s = EC_Scalar::deserialize(group, bytes)) {
return s.value();
} else {
throw Decoding_Error("EC private key is invalid for this group");
}
}
} // namespace
EC_PrivateKey_Data::EC_PrivateKey_Data(const EC_Group& group, std::span<const uint8_t> bytes) :
Botan::EC_PrivateKey_Data(group, decode_ec_secret_key_scalar(group, bytes)) {}
std::shared_ptr<EC_PublicKey_Data> EC_PrivateKey_Data::public_key(RandomNumberGenerator& rng,
bool with_modular_inverse) const {
auto public_point = [&] {
if(with_modular_inverse) {
return EC_AffinePoint::g_mul(m_scalar.invert(), rng);
} else {
return EC_AffinePoint::g_mul(m_scalar, rng);
}
};
return std::make_shared<EC_PublicKey_Data>(m_group, public_point());
}
std::shared_ptr<EC_PublicKey_Data> EC_PrivateKey_Data::public_key(bool with_modular_inverse) const {
Null_RNG null_rng;
return this->public_key(null_rng, with_modular_inverse);
}
void EC_PrivateKey_Data::serialize_to(std::span<uint8_t> output) const {
m_scalar.serialize_to(output);
}
} // namespace Botan