自学教程：C++ EC_POINT_set_compressed_coordinates_GFp函数代码示例

CSignerECDSA::CSignerECDSA(const uint8_t PrivData[32], unsigned char Signature[65]){    order.setuint256(g_Order);    EC_KEY* pkey = EC_KEY_new_by_curve_name(NID_secp256k1);    const EC_GROUP *group = EC_KEY_get0_group(pkey);    CBigNum privkey;    BN_bin2bn(PrivData, 32, &privkey);    EC_KEY_regenerate_key(pkey, &privkey);    EC_POINT *tmp_point = EC_POINT_new(group);    EC_POINT *test_point = EC_POINT_new(group);    CBigNum r, X, Y;    bool which = false;    do    {        // get random k        do            BN_rand_range(&kinv, &order);        while (!kinv);        /* We do not want timing information to leak the length of k,         * so we compute G*k using an equivalent scalar of fixed         * bit-length. */        kinv += order;        if (BN_num_bits(&kinv) <= 256)            kinv += order;        // compute r the x-coordinate of generator * k        EC_POINT_mul(group, tmp_point, &kinv, NULL, NULL, ctx);        EC_POINT_get_affine_coordinates_GFp(group, tmp_point, &X, &Y, ctx);        EC_POINT_set_compressed_coordinates_GFp(group, test_point, &X, 0, ctx);        which = !!EC_POINT_cmp(group, tmp_point, test_point, ctx);        BN_nnmod(&r, &X, &order, ctx);    }    while (!r);    // compute the inverse of k    BN_mod_inverse(&kinv, &kinv, &order, ctx);    BN_mod_mul(&pmr, &privkey, &r, &order, ctx);    BN_mod_mul(&prk, &pmr, &kinv, &order, ctx);    memset(Signature, 0, 65);    int nBitsR = BN_num_bits(&r);    BN_bn2bin(&r, &Signature[33-(nBitsR+7)/8]);    Signature[0] = 27 + which;    EC_POINT_free(tmp_point);    EC_POINT_free(test_point);    EC_KEY_free(pkey);}

EC_POINT *embed(const polypseud_ctx *ctx, const unsigned char *data, const size_t len) {   BIGNUM *t1 = BN_bin2bn(data, len, NULL);   BIGNUM *x = BN_new();   BN_mod(x, t1, ctx->p, ctx->bn_ctx);   EC_POINT *point = EC_POINT_new(ctx->ec_group);   unsigned char counter = 0;   int success = 0;   while(!success) {       success = EC_POINT_set_compressed_coordinates_GFp(ctx->ec_group, point, x, 1, ctx->bn_ctx);       if(!success) {           if(counter == 0) {               BN_lshift(x, x, 8);           }           BN_add(x, x, BN_value_one());       }   }   BN_free(x);   BN_free(t1);   return point;}

static int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,                                   const uint8_t *buf, size_t len,                                   BN_CTX *ctx) {  point_conversion_form_t form;  int y_bit;  BN_CTX *new_ctx = NULL;  BIGNUM *x, *y;  size_t field_len, enc_len;  int ret = 0;  if (len == 0) {    OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_BUFFER_TOO_SMALL);    return 0;  }  form = buf[0];  y_bit = form & 1;  form = form & ~1U;  if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED) &&      (form != POINT_CONVERSION_UNCOMPRESSED) &&      (form != POINT_CONVERSION_HYBRID)) {    OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);    return 0;  }  if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {    OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);    return 0;  }  if (form == 0) {    if (len != 1) {      OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);      return 0;    }    return EC_POINT_set_to_infinity(group, point);  }  field_len = BN_num_bytes(&group->field);  enc_len =      (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;  if (len != enc_len) {    OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);    return 0;  }  if (ctx == NULL) {    ctx = new_ctx = BN_CTX_new();    if (ctx == NULL)      return 0;  }  BN_CTX_start(ctx);  x = BN_CTX_get(ctx);  y = BN_CTX_get(ctx);  if (y == NULL)    goto err;  if (!BN_bin2bn(buf + 1, field_len, x))    goto err;  if (BN_ucmp(x, &group->field) >= 0) {    OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);    goto err;  }  if (form == POINT_CONVERSION_COMPRESSED) {    if (!EC_POINT_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx))      goto err;  } else {    if (!BN_bin2bn(buf + 1 + field_len, field_len, y))      goto err;    if (BN_ucmp(y, &group->field) >= 0) {      OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);      goto err;    }    if (form == POINT_CONVERSION_HYBRID) {      if (y_bit != BN_is_odd(y)) {        OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_INVALID_ENCODING);        goto err;      }    }    if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx))      goto err;  }  if (!EC_POINT_is_on_curve(group, point, ctx)) /* test required by X9.62 */  {    OPENSSL_PUT_ERROR(EC, ec_GFp_simple_oct2point, EC_R_POINT_IS_NOT_ON_CURVE);    goto err;  }  ret = 1;err:  BN_CTX_end(ctx);  if (new_ctx != NULL)    BN_CTX_free(new_ctx);  return ret;}

// Perform ECDSA key recovery (see SEC1 4.1.6) for curves over (mod p)-fields// recid selects which key is recovered// if check is nonzero, additional checks are performedint ECDSA_SIG_recover_key_GFp(EC_KEY *eckey, ECDSA_SIG *ecsig, const unsigned char *msg, int msglen, int recid, int check){    if (!eckey) return 0;    int ret = 0;    BN_CTX *ctx = NULL;    BIGNUM *x = NULL;    BIGNUM *e = NULL;    BIGNUM *order = NULL;    BIGNUM *sor = NULL;    BIGNUM *eor = NULL;    BIGNUM *field = NULL;    EC_POINT *R = NULL;    EC_POINT *O = NULL;    EC_POINT *Q = NULL;    BIGNUM *rr = NULL;    BIGNUM *zero = NULL;    int n = 0;    int i = recid / 2;    const EC_GROUP *group = EC_KEY_get0_group(eckey);    if ((ctx = BN_CTX_new()) == NULL) { ret = -1; goto err; }    BN_CTX_start(ctx);    order = BN_CTX_get(ctx);    if (!EC_GROUP_get_order(group, order, ctx)) { ret = -2; goto err; }    x = BN_CTX_get(ctx);    if (!BN_copy(x, order)) { ret=-1; goto err; }    if (!BN_mul_word(x, i)) { ret=-1; goto err; }    if (!BN_add(x, x, ecsig->r)) { ret=-1; goto err; }    field = BN_CTX_get(ctx);    if (!EC_GROUP_get_curve_GFp(group, field, NULL, NULL, ctx)) { ret=-2; goto err; }    if (BN_cmp(x, field) >= 0) { ret=0; goto err; }    if ((R = EC_POINT_new(group)) == NULL) { ret = -2; goto err; }    if (!EC_POINT_set_compressed_coordinates_GFp(group, R, x, recid % 2, ctx)) { ret=0; goto err; }    if (check)    {        if ((O = EC_POINT_new(group)) == NULL) { ret = -2; goto err; }        if (!EC_POINT_mul(group, O, NULL, R, order, ctx)) { ret=-2; goto err; }        if (!EC_POINT_is_at_infinity(group, O)) { ret = 0; goto err; }    }    if ((Q = EC_POINT_new(group)) == NULL) { ret = -2; goto err; }    n = EC_GROUP_get_degree(group);    e = BN_CTX_get(ctx);    if (!BN_bin2bn(msg, msglen, e)) { ret=-1; goto err; }    if (8*msglen > n) BN_rshift(e, e, 8-(n & 7));    zero = BN_CTX_get(ctx);    if (!BN_zero(zero)) { ret=-1; goto err; }    if (!BN_mod_sub(e, zero, e, order, ctx)) { ret=-1; goto err; }    rr = BN_CTX_get(ctx);    if (!BN_mod_inverse(rr, ecsig->r, order, ctx)) { ret=-1; goto err; }    sor = BN_CTX_get(ctx);    if (!BN_mod_mul(sor, ecsig->s, rr, order, ctx)) { ret=-1; goto err; }    eor = BN_CTX_get(ctx);    if (!BN_mod_mul(eor, e, rr, order, ctx)) { ret=-1; goto err; }    if (!EC_POINT_mul(group, Q, eor, R, sor, ctx)) { ret=-2; goto err; }    if (!EC_KEY_set_public_key(eckey, Q)) { ret=-2; goto err; }    ret = 1;err:    if (ctx) {        BN_CTX_end(ctx);        BN_CTX_free(ctx);    }    if (R != NULL) EC_POINT_free(R);    if (O != NULL) EC_POINT_free(O);    if (Q != NULL) EC_POINT_free(Q);    return ret;}

//.........这里部分代码省略.........    }    ctr = 0;    while (1) {	if (ctr > 10) {	    DEBUG("unable to find random point on curve for group %d, something's fishy", grp_num);	    goto fail;	}	ctr++;	/*	 * compute counter-mode password value and stretch to prime	 *    pwd-seed = H(token | peer-id | server-id | password |	 *		   counter)	 */	H_Init(&ctx);	H_Update(&ctx, (uint8_t *)token, sizeof(*token));	H_Update(&ctx, (uint8_t *)id_peer, id_peer_len);	H_Update(&ctx, (uint8_t *)id_server, id_server_len);	H_Update(&ctx, (uint8_t *)password, password_len);	H_Update(&ctx, (uint8_t *)&ctr, sizeof(ctr));	H_Final(&ctx, pwe_digest);	BN_bin2bn(pwe_digest, SHA256_DIGEST_LENGTH, rnd);	eap_pwd_kdf(pwe_digest, SHA256_DIGEST_LENGTH,		    "EAP-pwd Hunting And Pecking",		    strlen("EAP-pwd Hunting And Pecking"),		    prfbuf, primebitlen);	BN_bin2bn(prfbuf, primebytelen, x_candidate);	/*	 * eap_pwd_kdf() returns a string of bits 0..primebitlen but	 * BN_bin2bn will treat that string of bits as a big endian	 * number. If the primebitlen is not an even multiple of 8	 * then excessive bits-- those _after_ primebitlen-- so now	 * we have to shift right the amount we masked off.	 */	if (primebitlen % 8) {	    BN_rshift(x_candidate, x_candidate, (8 - (primebitlen % 8)));	}	if (BN_ucmp(x_candidate, sess->prime) >= 0) {	    continue;	}	/*	 * need to unambiguously identify the solution, if there is	 * one...	 */	if (BN_is_odd(rnd)) {	    is_odd = 1;	} else {	    is_odd = 0;	}	/*	 * solve the quadratic equation, if it's not solvable then we	 * don't have a point	 */	if (!EC_POINT_set_compressed_coordinates_GFp(sess->group,						     sess->pwe,						     x_candidate,						     is_odd, NULL)) {	    continue;	}	/*	 * If there's a solution to the equation then the point must be	 * on the curve so why check again explicitly? OpenSSL code	 * says this is required by X9.62. We're not X9.62 but it can't	 * hurt just to be sure.	 */	if (!EC_POINT_is_on_curve(sess->group, sess->pwe, NULL)) {	    DEBUG("EAP-pwd: point is not on curve");	    continue;	}	if (BN_cmp(cofactor, BN_value_one())) {	    /* make sure the point is not in a small sub-group */	    if (!EC_POINT_mul(sess->group, sess->pwe, NULL, sess->pwe,			      cofactor, NULL)) {		DEBUG("EAP-pwd: cannot multiply generator by order");		continue;	    }	    if (EC_POINT_is_at_infinity(sess->group, sess->pwe)) {		DEBUG("EAP-pwd: point is at infinity");		continue;	    }	}	/* if we got here then we have a new generator. */	break;    }    sess->group_num = grp_num;    if (0) {fail:				/* DON'T free sess, it's in handler->opaque */	ret = -1;    }    /* cleanliness and order.... */    BN_free(cofactor);    BN_free(x_candidate);    BN_free(rnd);    talloc_free(prfbuf);    return ret;}

//.........这里部分代码省略.........		eap_pwd_h_update(hash, id_server, id_server_len);		eap_pwd_h_update(hash, password, password_len);		eap_pwd_h_update(hash, &ctr, sizeof(ctr));		eap_pwd_h_final(hash, pwe_digest);		BN_bin2bn(pwe_digest, SHA256_MAC_LEN, rnd);		if (eap_pwd_kdf(pwe_digest, SHA256_MAC_LEN,				(u8 *) "EAP-pwd Hunting And Pecking",				os_strlen("EAP-pwd Hunting And Pecking"),				prfbuf, primebitlen) < 0)			goto fail;		BN_bin2bn(prfbuf, primebytelen, x_candidate);		/*		 * eap_pwd_kdf() returns a string of bits 0..primebitlen but		 * BN_bin2bn will treat that string of bits as a big endian		 * number. If the primebitlen is not an even multiple of 8		 * then excessive bits-- those _after_ primebitlen-- so now		 * we have to shift right the amount we masked off.		 */		if (primebitlen % 8)			BN_rshift(x_candidate, x_candidate,				  (8 - (primebitlen % 8)));		if (BN_ucmp(x_candidate, grp->prime) >= 0)			continue;		wpa_hexdump(MSG_DEBUG, "EAP-pwd: x_candidate",			    prfbuf, primebytelen);		/*		 * need to unambiguously identify the solution, if there is		 * one...		 */		if (BN_is_odd(rnd))			is_odd = 1;		else			is_odd = 0;		/*		 * solve the quadratic equation, if it's not solvable then we		 * don't have a point		 */		if (!EC_POINT_set_compressed_coordinates_GFp(grp->group,							     grp->pwe,							     x_candidate,							     is_odd, NULL))			continue;		/*		 * If there's a solution to the equation then the point must be		 * on the curve so why check again explicitly? OpenSSL code		 * says this is required by X9.62. We're not X9.62 but it can't		 * hurt just to be sure.		 */		if (!EC_POINT_is_on_curve(grp->group, grp->pwe, NULL)) {			wpa_printf(MSG_INFO, "EAP-pwd: point is not on curve");			continue;		}		if (BN_cmp(cofactor, BN_value_one())) {			/* make sure the point is not in a small sub-group */			if (!EC_POINT_mul(grp->group, grp->pwe, NULL, grp->pwe,					  cofactor, NULL)) {				wpa_printf(MSG_INFO, "EAP-pwd: cannot "					   "multiply generator by order");				continue;			}			if (EC_POINT_is_at_infinity(grp->group, grp->pwe)) {				wpa_printf(MSG_INFO, "EAP-pwd: point is at "					   "infinity");				continue;			}		}		/* if we got here then we have a new generator. */		break;	}	wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr);	grp->group_num = num;	if (0) { fail:		EC_GROUP_free(grp->group);		grp->group = NULL;		EC_POINT_free(grp->pwe);		grp->pwe = NULL;		BN_free(grp->order);		grp->order = NULL;		BN_free(grp->prime);		grp->prime = NULL;		ret = 1;	}	/* cleanliness and order.... */	BN_free(cofactor);	BN_free(x_candidate);	BN_free(rnd);	os_free(prfbuf);	return ret;}

static int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,                                   const uint8_t *buf, size_t len,                                   BN_CTX *ctx) {  point_conversion_form_t form;  int y_bit;  BN_CTX *new_ctx = NULL;  BIGNUM *x, *y;  size_t field_len, enc_len;  int ret = 0;  if (len == 0) {    OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);    return 0;  }  form = buf[0];  y_bit = form & 1;  form = form & ~1U;  if ((form != POINT_CONVERSION_COMPRESSED &&       form != POINT_CONVERSION_UNCOMPRESSED) ||      (form == POINT_CONVERSION_UNCOMPRESSED && y_bit)) {    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);    return 0;  }  field_len = BN_num_bytes(&group->field);  enc_len =      (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;  if (len != enc_len) {    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);    return 0;  }  if (ctx == NULL) {    ctx = new_ctx = BN_CTX_new();    if (ctx == NULL) {      return 0;    }  }  BN_CTX_start(ctx);  x = BN_CTX_get(ctx);  y = BN_CTX_get(ctx);  if (x == NULL || y == NULL) {    goto err;  }  if (!BN_bin2bn(buf + 1, field_len, x)) {    goto err;  }  if (BN_ucmp(x, &group->field) >= 0) {    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);    goto err;  }  if (form == POINT_CONVERSION_COMPRESSED) {    if (!EC_POINT_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx)) {      goto err;    }  } else {    if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) {      goto err;    }    if (BN_ucmp(y, &group->field) >= 0) {      OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);      goto err;    }    if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) {      goto err;    }  }  ret = 1;err:  BN_CTX_end(ctx);  BN_CTX_free(new_ctx);  return ret;}

void prime_field_tests()	{		BN_CTX *ctx = NULL;	BIGNUM *p, *a, *b;	EC_GROUP *group;	EC_GROUP *P_160 = NULL, *P_192 = NULL, *P_224 = NULL, *P_256 = NULL, *P_384 = NULL, *P_521 = NULL;	EC_POINT *P, *Q, *R;	BIGNUM *x, *y, *z;	unsigned char buf[100];	size_t i, len;	int k;	#if 1 /* optional */	ctx = BN_CTX_new();	if (!ctx) ABORT;#endif	p = BN_new();	a = BN_new();	b = BN_new();	if (!p || !a || !b) ABORT;	if (!BN_hex2bn(&p, "17")) ABORT;	if (!BN_hex2bn(&a, "1")) ABORT;	if (!BN_hex2bn(&b, "1")) ABORT;		group = EC_GROUP_new(EC_GFp_mont_method()); /* applications should use EC_GROUP_new_curve_GFp	                                             * so that the library gets to choose the EC_METHOD */	if (!group) ABORT;	if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx)) ABORT;	{		EC_GROUP *tmp;		tmp = EC_GROUP_new(EC_GROUP_method_of(group));		if (!tmp) ABORT;		if (!EC_GROUP_copy(tmp, group)) ABORT;		EC_GROUP_free(group);		group = tmp;	}		if (!EC_GROUP_get_curve_GFp(group, p, a, b, ctx)) ABORT;	fprintf(stdout, "Curve defined by Weierstrass equation/n     y^2 = x^3 + a*x + b  (mod 0x");	BN_print_fp(stdout, p);	fprintf(stdout, ")/n     a = 0x");	BN_print_fp(stdout, a);	fprintf(stdout, "/n     b = 0x");	BN_print_fp(stdout, b);	fprintf(stdout, "/n");	P = EC_POINT_new(group);	Q = EC_POINT_new(group);	R = EC_POINT_new(group);	if (!P || !Q || !R) ABORT;		if (!EC_POINT_set_to_infinity(group, P)) ABORT;	if (!EC_POINT_is_at_infinity(group, P)) ABORT;	buf[0] = 0;	if (!EC_POINT_oct2point(group, Q, buf, 1, ctx)) ABORT;	if (!EC_POINT_add(group, P, P, Q, ctx)) ABORT;	if (!EC_POINT_is_at_infinity(group, P)) ABORT;	x = BN_new();	y = BN_new();	z = BN_new();	if (!x || !y || !z) ABORT;	if (!BN_hex2bn(&x, "D")) ABORT;	if (!EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1, ctx)) ABORT;	if (!EC_POINT_is_on_curve(group, Q, ctx))		{		if (!EC_POINT_get_affine_coordinates_GFp(group, Q, x, y, ctx)) ABORT;		fprintf(stderr, "Point is not on curve: x = 0x");		BN_print_fp(stderr, x);		fprintf(stderr, ", y = 0x");		BN_print_fp(stderr, y);		fprintf(stderr, "/n");		ABORT;		}	fprintf(stdout, "A cyclic subgroup:/n");	k = 100;	do		{		if (k-- == 0) ABORT;		if (EC_POINT_is_at_infinity(group, P))			fprintf(stdout, "     point at infinity/n");		else			{			if (!EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)) ABORT;			fprintf(stdout, "     x = 0x");			BN_print_fp(stdout, x);			fprintf(stdout, ", y = 0x");			BN_print_fp(stdout, y);			fprintf(stdout, "/n");//.........这里部分代码省略.........