|
Mbed TLS v3.6.7
|
The ECP group structure. More...
#include <ecp.h>
Data Fields | |
| mbedtls_ecp_group_id | id |
| mbedtls_mpi | P |
| mbedtls_mpi | A |
| mbedtls_mpi | B |
| mbedtls_ecp_point | G |
| mbedtls_mpi | N |
| size_t | pbits |
| size_t | nbits |
| unsigned int | private_h |
| int(* | private_modp )(mbedtls_mpi *) |
| int(* | private_t_pre )(mbedtls_ecp_point *, void *) |
| int(* | private_t_post )(mbedtls_ecp_point *, void *) |
| void * | private_t_data |
| mbedtls_ecp_point * | private_T |
| size_t | private_T_size |
| const mbedtls_ecp_group_id | id |
| const mbedtls_mpi | P |
| const mbedtls_mpi | A |
| const mbedtls_mpi | B |
| const mbedtls_ecp_point | G |
| const mbedtls_mpi | N |
| const size_t | pbits |
| const size_t | nbits |
The ECP group structure.
We consider two types of curve equations:
y^2 = x^3 + A x + B mod P (SEC1 + RFC-4492) y^2 = x^3 + A x^2 + x mod P (Curve25519, Curve448)In both cases, the generator (G) for a prime-order subgroup is fixed.
For Short Weierstrass, this subgroup is the whole curve, and its cardinality is denoted by N. Our code requires that N is an odd prime as mbedtls_ecp_mul() requires an odd number, and mbedtls_ecdsa_sign() requires that it is prime for blinding purposes.
The default implementation only initializes A without setting it to the authentic value for curves with A = -3(SECP256R1, etc), in which case you need to load A by yourself when using domain parameters directly, for example:
For Montgomery curves, we do not store A, but (A + 2) / 4, which is the quantity used in the formulas. Additionally, nbits is not the size of N but the required size for private keys.
If modp is NULL, reduction modulo P is done using a generic algorithm. Otherwise, modp must point to a function that takes an mbedtls_mpi in the range of [0, 2^(2*pbits)), and transforms it in-place to an integer which is congruent mod P to the given MPI, is in the range [0, 2P), and has no more non-zero limbs than P, so that it may be efficiently brought into the range [0, P) by a single constant-time conditional subtraction. It must return 0 on success and non-zero on failure.
| const mbedtls_mpi mbedtls_ecp_group::A |
| mbedtls_mpi mbedtls_ecp_group::A |
For Short Weierstrass: A in the equation. Note that A is not set to the authentic value in some cases. Refer to detailed description of mbedtls_ecp_group if using domain parameters in the structure. For Montgomery curves: (A + 2) / 4.
Definition at line 225 of file ecp.h.
Referenced by mbedtls_ecp_group_a_is_minus_3().
| const mbedtls_mpi mbedtls_ecp_group::B |
| mbedtls_mpi mbedtls_ecp_group::B |
| const mbedtls_ecp_point mbedtls_ecp_group::G |
| mbedtls_ecp_point mbedtls_ecp_group::G |
| const mbedtls_ecp_group_id mbedtls_ecp_group::id |
| mbedtls_ecp_group_id mbedtls_ecp_group::id |
| const mbedtls_mpi mbedtls_ecp_group::N |
| mbedtls_mpi mbedtls_ecp_group::N |
| size_t mbedtls_ecp_group::nbits |
| const mbedtls_mpi mbedtls_ecp_group::P |
| mbedtls_mpi mbedtls_ecp_group::P |
| int(* mbedtls_ecp_group::private_modp) (mbedtls_mpi *) |
| mbedtls_ecp_point* mbedtls_ecp_group::private_T |
| int(* mbedtls_ecp_group::private_t_post) (mbedtls_ecp_point *, void *) |
| int(* mbedtls_ecp_group::private_t_pre) (mbedtls_ecp_point *, void *) |
| size_t mbedtls_ecp_group::private_T_size |
1.8.10