On 08/14/2011 07:43 PM, Niels Möller wrote: >> +/* assume curve is y^2 = x^3 - 3x + b >> + * instead of the generic y^2 = x^3 + ax + b >> + * >> + * (XXX: the generic case has been tested only >> + * with the SECG curves.) >> + */ > Maybe the naming in the itnerface should reflect that it's a special > case.
You can use the generic code by keeping ecc_projective_add_point.c instead of ecc_projective_add_point_3.c. I have not tested the generic code though with other curves than the SECP that use a = -3. The improvement from the special case is not that significant. >> +/* ---- ECC Routines ---- */ >> +/* size of our temp buffers for exported keys */ >> +#define ECC_BUF_SIZE 512 >> +/* max private key size */ >> +#define ECC_MAXSIZE 66 > Where do these maximums come from? >From the sizes of the supported groups. >> +/* Key generation */ >> +int ecc_make_key(void *random_ctx, nettle_random_func random, ecc_key *key, >> const ecc_set_type *dp); >> +int ecc_make_key_ex(void *random_ctx, nettle_random_func random, ecc_key >> *key, mpz_t prime, mpz_t order, mpz_t A, mpz_t Gx, mpz_t Gy); >> +void ecc_free(ecc_key *key); > I haven't figured out exactly what these do, but naming should most > likele be _init and _clear, for consistency with the rest of nettle and > with gmp. make_key is actually _init and _generate in one. >> +/* EC-Diffie-Hellman */ >> +int ecc_shared_secret(ecc_key *private_key, ecc_key *public_key, >> + unsigned char *out, unsigned long *outlen); > Haven't looked at this; for diffie-hellman over the normal ring one > would just use gmp's powm function. I think the corresponding ecc > function should also be public (maybe it already is?). Could be. This is a convenience function. >> +/* ECDSA */ >> +int ecc_sign_hash(const unsigned char *in, unsigned long inlen, >> + struct dsa_signature *signature, >> + void *random_ctx, nettle_random_func random, >> ecc_key *key); >> + >> +int ecc_verify_hash(struct dsa_signature * signature, >> + const unsigned char *hash, unsigned long hashlen, >> + int *stat, ecc_key *key); > Do these correspond to the _sign_digest and _verify_digest functions for > dsa and rsa? Indeed but they are not limited to a particular digest. Any hash can be used. >> +/* point ops (mp == montgomery digit) */ >> +/* R = 2P */ >> +int ecc_projective_dbl_point(ecc_point *P, ecc_point *R, mpz_t a, mpz_t >> modulus); >> + >> +/* R = P + Q */ >> +int ecc_projective_add_point(ecc_point *P, ecc_point *Q, ecc_point *R, >> mpz_t A, mpz_t modulus); > Is it customary jargon and notation to think about the the ecc group > operation as addition rather than multiplication? (Choice is arbitrary). I've never seen multiplication being used to describe this operation (either in cryptography or pure mathematics). >> +int mp_init_multi(mpz_t *a, ...); >> +void mp_clear_multi(mpz_t *a, ...); > Not sure I like these. They simplify code utilizing multiple mpz_ts significantly. regards, Nikos _______________________________________________ nettle-bugs mailing list [email protected] http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
