luna - wolfssl/wolfcrypt/src/port/nxp/ksdk

   1/* ksdk_port.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#ifdef HAVE_CONFIG_H
  23    #include <config.h>
  24#endif
  25
  26#include <wolfssl/wolfcrypt/settings.h>
  27#ifdef NO_INLINE
  28    #include <wolfssl/wolfcrypt/misc.h>
  29#else
  30    #define WOLFSSL_MISC_INCLUDED
  31    #include <wolfcrypt/src/misc.c>
  32#endif
  33
  34/* If FREESCALE_LTC_TFM or FREESCALE_LTC_ECC */
  35#if defined(FREESCALE_LTC_TFM) || defined(FREESCALE_LTC_ECC)
  36
  37#include <wolfssl/wolfcrypt/port/nxp/ksdk_port.h>
  38#include <wolfssl/wolfcrypt/random.h>
  39#include <wolfssl/wolfcrypt/error-crypt.h>
  40#include <wolfssl/wolfcrypt/logging.h>
  41#include <stdint.h>
  42
  43#define ERROR_OUT(res) { ret = (res); goto done; }
  44
  45/* For debugging only - Enable this to do software tests of each operation */
  46/* #define ENABLE_NXPLTC_TESTS */
  47#ifdef ENABLE_NXPLTC_TESTS
  48static int doLtcTest = 0;
  49#endif
  50
  51int ksdk_port_init(void)
  52{
  53#if defined(FREESCALE_LTC_TFM)
  54    LTC_Init(LTC0);
  55#endif
  56
  57    return 0;
  58}
  59
  60/* Reverse array in memory (in place) */
  61static void ltc_reverse_array(uint8_t *src, size_t src_len)
  62{
  63    unsigned int i;
  64
  65    for (i = 0; i < src_len / 2; i++) {
  66        uint8_t tmp;
  67
  68        tmp = src[i];
  69        src[i] = src[src_len - 1 - i];
  70        src[src_len - 1 - i] = tmp;
  71    }
  72}
  73
  74
  75#ifndef WOLFSSL_SP_MATH
  76/* same as mp_to_unsigned_bin() with mp_reverse() skipped */
  77static int mp_to_unsigned_lsb_bin(mp_int *a, unsigned char *b)
  78{
  79    int res;
  80    mp_int t;
  81
  82    res = mp_init_copy(&t, a);
  83    if (res == MP_OKAY) {
  84        res = mp_to_unsigned_bin_at_pos(0, &t, b);
  85        if (res >= 0)
  86            res = 0;
  87    #ifndef USE_FAST_MATH
  88        mp_clear(&t);
  89    #endif
  90    }
  91
  92    return res;
  93}
  94#endif
  95
  96static int ltc_get_lsb_bin_from_mp_int(uint8_t *dst, mp_int *A, uint16_t *psz)
  97{
  98    int res;
  99    uint16_t sz;
 100
 101    sz = mp_unsigned_bin_size(A);
 102#ifndef WOLFSSL_SP_MATH
 103    /* result is lsbyte at lowest addr as required by LTC */
 104    res = mp_to_unsigned_lsb_bin(A, dst);
 105#else
 106    res = mp_to_unsigned_bin(A, dst);
 107    if (res == MP_OKAY) {
 108        ltc_reverse_array(dst, sz);
 109    }
 110#endif
 111    *psz = sz;
 112    return res;
 113}
 114
 115/* LTC TFM */
 116#if defined(FREESCALE_LTC_TFM)
 117
 118/* these function are used by wolfSSL upper layers (like RSA) */
 119
 120/* c = a * b */
 121int mp_mul(mp_int *A, mp_int *B, mp_int *C)
 122{
 123    int res = MP_OKAY;
 124    status_t status;
 125    int szA, szB;
 126
 127#ifdef ENABLE_NXPLTC_TESTS
 128    mp_int t;
 129    mp_init(&t);
 130    if (doLtcTest)
 131        wolfcrypt_mp_mul(A, B, &t);
 132#endif
 133
 134    szA = mp_unsigned_bin_size(A);
 135    szB = mp_unsigned_bin_size(B);
 136
 137    /* if unsigned mul can fit into LTC PKHA let's use it, otherwise call
 138     * software mul */
 139    if ((szA <= LTC_MAX_INT_BYTES / 2) && (szB <= LTC_MAX_INT_BYTES / 2)) {
 140        uint8_t *ptrA = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 141            DYNAMIC_TYPE_BIGINT);
 142        uint8_t *ptrB = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 143            DYNAMIC_TYPE_BIGINT);
 144        uint8_t *ptrN = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 145            DYNAMIC_TYPE_BIGINT);
 146        uint8_t *ptrC = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 147            DYNAMIC_TYPE_BIGINT);
 148
 149        /* unsigned multiply */
 150#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 151      defined(WOLFSSL_SP_INT_NEGATIVE)
 152        int neg = (A->sign == B->sign) ? MP_ZPOS : MP_NEG;
 153#endif
 154
 155        if (ptrA && ptrB && ptrN && ptrC) {
 156            uint16_t sizeA, sizeB, sizeN, sizeC = 0;
 157
 158            res = ltc_get_lsb_bin_from_mp_int(ptrA, A, &sizeA);
 159            if (res == MP_OKAY)
 160                res = ltc_get_lsb_bin_from_mp_int(ptrB, B, &sizeB);
 161            if (res == MP_OKAY) {
 162                sizeN = sizeA + sizeB;
 163                XMEMSET(ptrN, 0xFF, sizeN);
 164                XMEMSET(ptrC, 0, LTC_MAX_INT_BYTES);
 165
 166                status = LTC_PKHA_ModMul(LTC_BASE,
 167                    ptrA, sizeA,  /* first integer */
 168                    ptrB, sizeB,  /* second integer */
 169                    ptrN, sizeN,  /* modulus */
 170                    ptrC, &sizeC, /* out */
 171                    kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
 172                    kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
 173                if (status == kStatus_Success) {
 174                    ltc_reverse_array(ptrC, sizeC);
 175                    res = mp_read_unsigned_bin(C, ptrC, sizeC);
 176
 177#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 178      defined(WOLFSSL_SP_INT_NEGATIVE)
 179                    /* fix sign */
 180                    C->sign = neg;
 181#endif
 182                }
 183                else {
 184                    res = MP_VAL;
 185                }
 186            }
 187        }
 188        else {
 189            res = MP_MEM;
 190        }
 191
 192        XFREE(ptrA, NULL, DYNAMIC_TYPE_BIGINT);
 193        XFREE(ptrB, NULL, DYNAMIC_TYPE_BIGINT);
 194        XFREE(ptrN, NULL, DYNAMIC_TYPE_BIGINT);
 195        XFREE(ptrC, NULL, DYNAMIC_TYPE_BIGINT);
 196    }
 197    else {
 198#ifdef WOLFSSL_SP_MATH
 199        res = sp_mul(A, B, C);
 200#else
 201        res = wolfcrypt_mp_mul(A, B, C);
 202#endif
 203    }
 204
 205#ifdef ENABLE_NXPLTC_TESTS
 206    /* compare hardware vs software */
 207    if (doLtcTest && mp_cmp(&t, C) != MP_EQ) {
 208        printf("mp_mul test fail!\n");
 209
 210        mp_dump("C", C, 0);
 211        mp_dump("C soft", &t, 0);
 212    }
 213    mp_clear(&t);
 214#endif
 215
 216    return res;
 217}
 218
 219/* c = a mod b, 0 <= c < b  */
 220int mp_mod(mp_int *a, mp_int *b, mp_int *c)
 221{
 222    int res = MP_OKAY;
 223    int szA, szB;
 224
 225#ifdef ENABLE_NXPLTC_TESTS
 226    mp_int t;
 227    mp_init(&t);
 228    if (doLtcTest)
 229        wolfcrypt_mp_mod(a, b, &t);
 230#endif
 231
 232    szA = mp_unsigned_bin_size(a);
 233    szB = mp_unsigned_bin_size(b);
 234    if ((szA <= LTC_MAX_INT_BYTES) && (szB <= LTC_MAX_INT_BYTES)) {
 235        uint8_t *ptrA = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 236            DYNAMIC_TYPE_BIGINT);
 237        uint8_t *ptrB = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 238            DYNAMIC_TYPE_BIGINT);
 239        uint8_t *ptrC = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 240            DYNAMIC_TYPE_BIGINT);
 241
 242#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 243      defined(WOLFSSL_SP_INT_NEGATIVE)
 244        /* get sign for the result */
 245        int neg = (a->sign == b->sign) ? MP_ZPOS : MP_NEG;
 246#endif
 247
 248        /* get remainder of unsigned a divided by unsigned b */
 249        if (ptrA && ptrB && ptrC) {
 250            uint16_t sizeA, sizeB, sizeC;
 251
 252            res = ltc_get_lsb_bin_from_mp_int(ptrA, a, &sizeA);
 253            if (res == MP_OKAY)
 254                res = ltc_get_lsb_bin_from_mp_int(ptrB, b, &sizeB);
 255            if (res == MP_OKAY) {
 256                if (kStatus_Success ==
 257                    LTC_PKHA_ModRed(LTC_BASE, ptrA, sizeA, ptrB, sizeB, ptrC,
 258                        &sizeC, kLTC_PKHA_IntegerArith))
 259                {
 260                    ltc_reverse_array(ptrC, sizeC);
 261                    res = mp_read_unsigned_bin(c, ptrC, sizeC);
 262
 263#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 264      defined(WOLFSSL_SP_INT_NEGATIVE)
 265                    /* fix sign */
 266                    c->sign = neg;
 267#endif
 268                }
 269                else {
 270                    res = MP_VAL;
 271                }
 272            }
 273        }
 274        else {
 275            res = MP_MEM;
 276        }
 277
 278        XFREE(ptrA, NULL, DYNAMIC_TYPE_BIGINT);
 279        XFREE(ptrB, NULL, DYNAMIC_TYPE_BIGINT);
 280        XFREE(ptrC, NULL, DYNAMIC_TYPE_BIGINT);
 281    }
 282    else {
 283#if defined(FREESCALE_LTC_TFM_RSA_4096_ENABLE)
 284        res = wolfcrypt_mp_mod(a, b, c);
 285#else
 286        res = NOT_COMPILED_IN;
 287#endif
 288    }
 289
 290#ifdef ENABLE_NXPLTC_TESTS
 291    /* compare hardware vs software */
 292    if (doLtcTest && mp_cmp(&t, c) != MP_EQ) {
 293        printf("mp_mod test fail!\n");
 294
 295        mp_dump("C", c, 0);
 296        mp_dump("C soft", &t, 0);
 297    }
 298    mp_clear(&t);
 299#endif
 300
 301    return res;
 302}
 303
 304/* c = 1/a (mod b) for odd b only */
 305int mp_invmod(mp_int *a, mp_int *b, mp_int *c)
 306{
 307    int res = MP_OKAY;
 308    int szA, szB;
 309
 310#ifdef ENABLE_NXPLTC_TESTS
 311    mp_int t;
 312    mp_init(&t);
 313    if (doLtcTest)
 314        wolfcrypt_mp_invmod(a, b, &t);
 315#endif
 316
 317    szA = mp_unsigned_bin_size(a);
 318    szB = mp_unsigned_bin_size(b);
 319    if ((szA <= LTC_MAX_INT_BYTES) && (szB <= LTC_MAX_INT_BYTES)) {
 320        uint8_t *ptrA = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 321            DYNAMIC_TYPE_BIGINT);
 322        uint8_t *ptrB = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 323            DYNAMIC_TYPE_BIGINT);
 324        uint8_t *ptrC = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL,
 325            DYNAMIC_TYPE_BIGINT);
 326
 327        if (ptrA && ptrB && ptrC) {
 328            uint16_t sizeA, sizeB, sizeC;
 329
 330            res = ltc_get_lsb_bin_from_mp_int(ptrA, a, &sizeA);
 331            if (res == MP_OKAY)
 332                res = ltc_get_lsb_bin_from_mp_int(ptrB, b, &sizeB);
 333
 334            /* if a >= b then reduce */
 335            /* TODO: Perhaps always do mod reduce depending on hardware performance */
 336            if (res == MP_OKAY &&
 337                        LTC_PKHA_CompareBigNum(ptrA, sizeA, ptrB, sizeB) >= 0) {
 338                if (LTC_PKHA_ModRed(LTC_BASE, ptrA, sizeA, ptrB, sizeB,
 339                    ptrA, &sizeA, kLTC_PKHA_IntegerArith) != kStatus_Success) {
 340                    res = MP_VAL;
 341                }
 342            }
 343            if (res == MP_OKAY) {
 344                if (LTC_PKHA_ModInv(LTC_BASE, ptrA, sizeA, ptrB, sizeB, ptrC,
 345                        &sizeC, kLTC_PKHA_IntegerArith) == kStatus_Success) {
 346                    ltc_reverse_array(ptrC, sizeC);
 347                    res = mp_read_unsigned_bin(c, ptrC, sizeC);
 348
 349
 350#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 351      defined(WOLFSSL_SP_INT_NEGATIVE)
 352                    c->sign = a->sign;
 353#endif
 354                }
 355                else {
 356                    res = MP_VAL;
 357                }
 358            }
 359        }
 360        else {
 361            res = MP_MEM;
 362        }
 363
 364        XFREE(ptrA, NULL, DYNAMIC_TYPE_BIGINT);
 365        XFREE(ptrB, NULL, DYNAMIC_TYPE_BIGINT);
 366        XFREE(ptrC, NULL, DYNAMIC_TYPE_BIGINT);
 367    }
 368    else {
 369#if defined(FREESCALE_LTC_TFM_RSA_4096_ENABLE)
 370        res = wolfcrypt_mp_invmod(a, b, c);
 371#else
 372        res = NOT_COMPILED_IN;
 373#endif
 374    }
 375
 376#ifdef ENABLE_NXPLTC_TESTS
 377    /* compare hardware vs software */
 378    if (doLtcTest && mp_cmp(&t, c) != MP_EQ) {
 379        printf("mp_invmod test fail!\n");
 380
 381        mp_dump("C", c, 0);
 382        mp_dump("C soft", &t, 0);
 383    }
 384    mp_clear(&t);
 385#endif
 386
 387    return res;
 388}
 389
 390/* d = a * b (mod c) */
 391/* with blinding enabled ptr a can equal ptr d */
 392int mp_mulmod(mp_int *a, mp_int *b, mp_int *c, mp_int *d)
 393{
 394    int res = MP_OKAY;
 395    status_t status;
 396    int szA, szB, szC;
 397
 398#ifdef ENABLE_NXPLTC_TESTS
 399    mp_int t;
 400    mp_init(&t);
 401    if (doLtcTest)
 402        wolfcrypt_mp_mulmod(a, b, c, &t);
 403#endif
 404
 405    szA = mp_unsigned_bin_size(a);
 406    szB = mp_unsigned_bin_size(b);
 407    szC = mp_unsigned_bin_size(c);
 408
 409    /* LTC hardware seems to have issue with ModMul with 511 bytes or more,
 410        so use software math */
 411    if ((szA + szB < LTC_MAX_INT_BYTES-1) && (szC <=  LTC_MAX_INT_BYTES))
 412    {
 413        uint8_t *ptrA, *ptrB, *ptrC, *ptrD;
 414
 415        ptrA = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 416        ptrB = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 417        ptrC = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 418        ptrD = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 419
 420        if (ptrA && ptrB && ptrC && ptrD) {
 421            uint16_t sizeA, sizeB, sizeC, sizeD = 0;
 422
 423            /* unsigned multiply */
 424#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 425      defined(WOLFSSL_SP_INT_NEGATIVE)
 426            int neg = (a->sign == b->sign) ? MP_ZPOS : MP_NEG;
 427#endif
 428
 429            /* Multiply A * B = D */
 430            res = ltc_get_lsb_bin_from_mp_int(ptrA, a, &sizeA);
 431            if (res == MP_OKAY)
 432                res = ltc_get_lsb_bin_from_mp_int(ptrB, b, &sizeB);
 433            if (res == MP_OKAY) {
 434                /* modulus C is all F's for integer multiply */
 435                sizeC = sizeA + sizeB;
 436                XMEMSET(ptrC, 0xFF, sizeC);
 437                XMEMSET(ptrD, 0, LTC_MAX_INT_BYTES);
 438
 439                status = LTC_PKHA_ModMul(LTC_BASE,
 440                    ptrA, sizeA,  /* first integer */
 441                    ptrB, sizeB,  /* second integer */
 442                    ptrC, sizeC,  /* modulus */
 443                    ptrD, &sizeD, /* out */
 444                    kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
 445                    kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
 446                if (status != kStatus_Success)
 447                    res = MP_VAL;
 448            }
 449            /* load modulus */
 450            if (res == MP_OKAY)
 451                res = ltc_get_lsb_bin_from_mp_int(ptrC, c, &sizeC);
 452            /* perform D mod C = D */
 453            if (res == MP_OKAY) {
 454                status = LTC_PKHA_ModRed(LTC_BASE,
 455                    ptrD, sizeD,
 456                    ptrC, sizeC,
 457                    ptrD, &sizeD,
 458                    kLTC_PKHA_IntegerArith);
 459                if (status != kStatus_Success)
 460                    res = MP_VAL;
 461            }
 462            if (res == MP_OKAY) {
 463                ltc_reverse_array(ptrD, sizeD);
 464                res = mp_read_unsigned_bin(d, ptrD, sizeD);
 465
 466#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
 467      defined(WOLFSSL_SP_INT_NEGATIVE)
 468                /* fix sign */
 469                d->sign = neg;
 470#endif
 471            }
 472        }
 473        else {
 474            res = MP_MEM;
 475        }
 476
 477        XFREE(ptrA, NULL, DYNAMIC_TYPE_BIGINT);
 478        XFREE(ptrB, NULL, DYNAMIC_TYPE_BIGINT);
 479        XFREE(ptrC, NULL, DYNAMIC_TYPE_BIGINT);
 480        XFREE(ptrD, NULL, DYNAMIC_TYPE_BIGINT);
 481    }
 482    else {
 483#if defined(FREESCALE_LTC_TFM_RSA_4096_ENABLE)
 484        res = wolfcrypt_mp_mulmod(a, b, c, d);
 485#else
 486        res = NOT_COMPILED_IN;
 487#endif
 488    }
 489
 490#ifdef ENABLE_NXPLTC_TESTS
 491    /* compare hardware vs software */
 492    if (doLtcTest && mp_cmp(&t, d) != MP_EQ) {
 493        printf("mp_mulmod test fail!\n");
 494
 495        mp_dump("D", d, 0);
 496        mp_dump("D soft", &t, 0);
 497    }
 498    mp_clear(&t);
 499#endif
 500
 501    return res;
 502}
 503
 504/* Y = G^X mod P */
 505int ltc_mp_exptmod(mp_int *G, mp_int *X, mp_int *P, mp_int *Y, int useConstTime)
 506{
 507    int res = MP_OKAY;
 508    int szG, szX, szP;
 509
 510#ifdef ENABLE_NXPLTC_TESTS
 511    mp_int t;
 512    mp_init(&t);
 513    if (doLtcTest)
 514        wolfcrypt_mp_exptmod(G, X, P, &t);
 515#endif
 516
 517    szG = mp_unsigned_bin_size(G);
 518    szX = mp_unsigned_bin_size(X);
 519    szP = mp_unsigned_bin_size(P);
 520
 521    if ((szG <= LTC_MAX_INT_BYTES) &&
 522        (szX <= LTC_MAX_INT_BYTES) &&
 523        (szP <= LTC_MAX_INT_BYTES))
 524    {
 525        uint16_t sizeG, sizeX, sizeP, sizeY;
 526        uint8_t *ptrG, *ptrX, *ptrP, *ptrY;
 527
 528        ptrG = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 529        ptrX = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 530        ptrP = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 531        ptrY = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 532        if (ptrG && ptrX && ptrP && ptrY) {
 533            res = ltc_get_lsb_bin_from_mp_int(ptrG, G, &sizeG);
 534            if (res == MP_OKAY)
 535                res = ltc_get_lsb_bin_from_mp_int(ptrX, X, &sizeX);
 536            if (res == MP_OKAY)
 537                res = ltc_get_lsb_bin_from_mp_int(ptrP, P, &sizeP);
 538
 539            /* if G >= P then reduce */
 540            /* TODO: Perhaps always do mod reduce depending on hardware performance */
 541            if (res == MP_OKAY &&
 542                        LTC_PKHA_CompareBigNum(ptrG, sizeG, ptrP, sizeP) >= 0) {
 543                res = LTC_PKHA_ModRed(LTC_BASE,
 544                    ptrG, sizeG,
 545                    ptrP, sizeP,
 546                    ptrG, &sizeG, kLTC_PKHA_IntegerArith);
 547                res = (res == kStatus_Success) ? MP_OKAY: MP_VAL;
 548            }
 549            if (res == MP_OKAY) {
 550                res = LTC_PKHA_ModExp(LTC_BASE,
 551                    ptrG, sizeG,  /* integer input */
 552                    ptrP, sizeP,  /* modulus */
 553                    ptrX, sizeX,  /* exponent */
 554                    ptrY, &sizeY, /* out */
 555                    kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
 556                    useConstTime ? kLTC_PKHA_TimingEqualized :
 557                                   kLTC_PKHA_NoTimingEqualized);
 558                res = (res == kStatus_Success) ? MP_OKAY: MP_VAL;
 559            }
 560            if (res == MP_OKAY) {
 561                ltc_reverse_array(ptrY, sizeY);
 562                res = mp_read_unsigned_bin(Y, ptrY, sizeY);
 563            }
 564        }
 565        else {
 566            res = MP_MEM;
 567        }
 568
 569        XFREE(ptrY, NULL, DYNAMIC_TYPE_BIGINT);
 570        XFREE(ptrP, NULL, DYNAMIC_TYPE_BIGINT);
 571        XFREE(ptrX, NULL, DYNAMIC_TYPE_BIGINT);
 572        XFREE(ptrG, NULL, DYNAMIC_TYPE_BIGINT);
 573    }
 574    else {
 575#if defined(FREESCALE_LTC_TFM_RSA_4096_ENABLE)
 576        res = wolfcrypt_mp_exptmod(G, X, P, Y);
 577#else
 578        res = NOT_COMPILED_IN;
 579#endif
 580    }
 581
 582#ifdef ENABLE_NXPLTC_TESTS
 583    /* compare hardware vs software */
 584    if (doLtcTest && mp_cmp(&t, Y) != MP_EQ) {
 585        printf("mp_exptmod test fail!\n");
 586
 587        mp_dump("Y", Y, 0);
 588        mp_dump("Y soft", &t, 0);
 589    }
 590    mp_clear(&t);
 591#endif
 592
 593    return res;
 594}
 595
 596int mp_exptmod(mp_int *G, mp_int *X, mp_int *P, mp_int *Y)
 597{
 598    return ltc_mp_exptmod(G, X, P, Y, 1);
 599}
 600
 601int mp_exptmod_nct(mp_int * G, mp_int * X, mp_int * P, mp_int * Y)
 602{
 603    return ltc_mp_exptmod(G, X, P, Y, 0);
 604}
 605
 606#if !defined(NO_DH) || !defined(NO_DSA) || !defined(NO_RSA) || \
 607    defined(WOLFSSL_KEY_GEN)
 608int mp_prime_is_prime_ex(mp_int* a, int t, int* result, WC_RNG* rng)
 609{
 610    int res = MP_OKAY;
 611    int szA;
 612
 613#ifdef ENABLE_NXPLTC_TESTS
 614    int result_soft = 0;
 615    if (doLtcTest)
 616        mp_prime_is_prime_ex(a, t, &result_soft, rng);
 617#endif
 618
 619    szA = mp_unsigned_bin_size(a);
 620    if (szA <= LTC_MAX_INT_BYTES) {
 621        uint16_t sizeA, sizeB;
 622        uint8_t *ptrA, *ptrB;
 623
 624        sizeB = mp_count_bits(a);
 625        /* The base size is the number of bits / 8. One is added if the number
 626         * of bits isn't an even 8. */
 627        sizeB = (sizeB / 8) + ((sizeB % 8) ? 1 : 0);
 628
 629        ptrA = (uint8_t*)XMALLOC(LTC_MAX_INT_BYTES, NULL, DYNAMIC_TYPE_BIGINT);
 630        ptrB = (uint8_t*)XMALLOC(sizeB, NULL, DYNAMIC_TYPE_BIGINT);
 631        if (ptrA == NULL || ptrB == NULL) {
 632            res = MEMORY_E;
 633        }
 634
 635        if (res == MP_OKAY) {
 636        #ifndef WC_NO_RNG
 637            /* A NULL rng will return as bad function arg */
 638            res = wc_RNG_GenerateBlock(rng, ptrB, sizeB);
 639        #else
 640            res = NOT_COMPILED_IN;
 641        #endif
 642        }
 643
 644        if (res == MP_OKAY) {
 645            res = ltc_get_lsb_bin_from_mp_int(ptrA, a, &sizeA);
 646        }
 647        if (res == MP_OKAY) {
 648            if (LTC_PKHA_PrimalityTest(LTC_BASE,
 649                ptrB, sizeB,             /* seed */
 650                (uint8_t*)&t, sizeof(t), /* trials */
 651                ptrA, sizeA,             /* candidate */
 652                (bool*)result) != kStatus_Success) {
 653                res = MP_MEM;
 654            }
 655        }
 656
 657        XFREE(ptrB, NULL, DYNAMIC_TYPE_BIGINT);
 658        XFREE(ptrA, NULL, DYNAMIC_TYPE_BIGINT);
 659    }
 660    else {
 661#if defined(FREESCALE_LTC_TFM_RSA_4096_ENABLE)
 662        res = wolfcrypt_mp_prime_is_prime_ex(a, t, result, rng);
 663#else
 664        res = NOT_COMPILED_IN;
 665#endif
 666    }
 667
 668#ifdef ENABLE_NXPLTC_TESTS
 669    /* compare hardware vs software */
 670    if (doLtcTest && *result != result_soft) {
 671        printf("Fail! mp_prime_is_prime_ex %d != %d\n", *result, result_soft);
 672    }
 673#endif
 674
 675    return res;
 676}
 677
 678int mp_prime_is_prime(mp_int* a, int t, int* result)
 679{
 680    /* the NXP LTC prime check requires an RNG, so use software version */
 681    return wolfcrypt_mp_prime_is_prime_ex(a, t, result, NULL);
 682}
 683#endif /* !NO_RSA || !NO_DSA || !NO_DH || WOLFSSL_KEY_GEN */
 684
 685#endif /* FREESCALE_LTC_TFM */
 686
 687
 688/* ECC */
 689#if defined(HAVE_ECC) && defined(FREESCALE_LTC_ECC)
 690
 691/* convert from mp_int to LTC integer, as array of bytes of size sz.
 692 * if mp_int has less bytes than sz, add zero bytes at most significant byte
 693 *   positions.
 694 * This is when for example modulus is 32 bytes (P-256 curve)
 695 * and mp_int has only 31 bytes, we add leading zeros
 696 * so that result array has 32 bytes, same as modulus (sz).
 697 */
 698static int ltc_get_from_mp_int(uint8_t *dst, mp_int *a, int sz)
 699{
 700    int res;
 701    int szbin;
 702    int offset;
 703
 704    /* check how many bytes are in the mp_int */
 705    szbin = mp_unsigned_bin_size(a);
 706
 707    /* compute offset from dst */
 708    offset = sz - szbin;
 709    if (offset < 0)
 710        offset = 0;
 711    if (offset > sz)
 712        offset = sz;
 713
 714    /* add leading zeroes */
 715    if (offset)
 716        XMEMSET(dst, 0, offset);
 717
 718    /* convert mp_int to array of bytes */
 719    res = mp_to_unsigned_bin(a, dst + offset);
 720
 721    if (res == MP_OKAY) {
 722        /* reverse array for LTC direct use */
 723        ltc_reverse_array(dst, sz);
 724    }
 725
 726    return res;
 727}
 728
 729/* ECC specs in lsbyte at lowest address format for direct use by LTC PKHA
 730 * driver functions */
 731#if defined(HAVE_ECC192) || defined(HAVE_ALL_CURVES)
 732#define ECC192
 733#endif
 734#if defined(HAVE_ECC224) || defined(HAVE_ALL_CURVES)
 735#define ECC224
 736#endif
 737#if !defined(NO_ECC256) || defined(HAVE_ALL_CURVES)
 738#define ECC256
 739#endif
 740#if defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)
 741#define ECC384
 742#endif
 743
 744#ifdef ECC192
 745#ifndef NO_ECC_SECP
 746static const uint8_t ltc_secp192r1_modulus[24] = {
 747    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF,
 748    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 749static const uint8_t ltc_secp192r1_r2modn[24] = {
 750    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
 751    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 752static const uint8_t ltc_secp192r1_aCurveParam[24] = {
 753    0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF,
 754    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 755static const uint8_t ltc_secp192r1_bCurveParam[24] = {
 756    0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE, 0x49, 0x30, 0x24, 0x72,
 757    0xAB, 0xE9, 0xA7, 0x0F, 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64};
 758#endif
 759#ifdef HAVE_ECC_KOBLITZ
 760static const uint8_t ltc_secp192k1_modulus[24] = {
 761    0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 762    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 763static const uint8_t ltc_secp192k1_r2modn[24] = {
 764    0xD1, 0x4F, 0x3C, 0x01, 0x92, 0x23, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
 765    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 766static const uint8_t ltc_secp192k1_aCurveParam[24] = {
 767    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 768    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 769static const uint8_t ltc_secp192k1_bCurveParam[24] = {
 770    0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 771    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 772#endif
 773#endif /* ECC192 */
 774
 775#ifdef ECC224
 776#ifndef NO_ECC_SECP
 777static const uint8_t ltc_secp224r1_modulus[28] = {
 778    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 779    0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 780    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 781static const uint8_t ltc_secp224r1_r2modn[28] = {
 782    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 783    0x00, 0x00, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 784    0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00};
 785static const uint8_t ltc_secp224r1_aCurveParam[28] = {
 786    0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 787    0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 788    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 789static const uint8_t ltc_secp224r1_bCurveParam[28] = {
 790    0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27, 0xBA, 0xD8,
 791    0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50, 0x56, 0x32, 0x41, 0xF5,
 792    0xAB, 0xB3, 0x04, 0x0C, 0x85, 0x0A, 0x05, 0xB4};
 793#endif
 794#ifdef HAVE_ECC_KOBLITZ
 795static const uint8_t ltc_secp224k1_modulus[28] = {
 796    0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 797    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 798    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 799static const uint8_t ltc_secp224k1_r2modn[28] = {
 800    0x69, 0x30, 0xC2, 0x02, 0x26, 0x35, 0x00, 0x00, 0x01, 0x00,
 801    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 802    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 803static const uint8_t ltc_secp224k1_aCurveParam[28] = {
 804    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 805    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 806    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 807static const uint8_t ltc_secp224k1_bCurveParam[28] = {
 808    0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 809    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 810    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 811#endif
 812#endif /* ECC224 */
 813
 814#ifdef ECC256
 815#ifndef NO_ECC_SECP
 816static const uint8_t ltc_secp256r1_modulus[32] = {
 817    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 818    0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 819    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF};
 820static const uint8_t ltc_secp256r1_r2modn[32] = { /* R^2 mod N */
 821    0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF,
 822    0xFF, 0xFB, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 823    0xFF, 0xFF, 0xFD, 0xFF, 0xFF, 0xFF, 0x04, 0x00, 0x00, 0x00};
 824static const uint8_t ltc_secp256r1_aCurveParam[32] = {
 825    0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 826    0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 827    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF};
 828static const uint8_t ltc_secp256r1_bCurveParam[32] = {
 829    0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B, 0xF6, 0xB0, 0x53,
 830    0xCC, 0xB0, 0x06, 0x1D, 0x65, 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD,
 831    0xEB, 0xB3, 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A};
 832#endif
 833#ifdef HAVE_ECC_KOBLITZ
 834static const uint8_t ltc_secp256k1_modulus[32] = {
 835    0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 836    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
 837    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 838static const uint8_t ltc_secp256k1_r2modn[32] = { /* R^2 mod N */
 839    0xA1, 0x90, 0x0E, 0x00, 0xA2, 0x07, 0x00, 0x00, 0x01, 0x00, 0x00,
 840    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 841    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 842static const uint8_t ltc_secp256k1_aCurveParam[32] = {
 843    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 844    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 845    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 846static const uint8_t ltc_secp256k1_bCurveParam[32] = {
 847    0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 848    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 849    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 850#endif
 851#endif /* ECC256 */
 852
 853#ifdef ECC384
 854#ifndef NO_ECC_SECP
 855static const uint8_t ltc_secp384r1_modulus[48] = {
 856    0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 857    0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 858    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 859    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 860static const uint8_t ltc_secp384r1_r2modn[48] = {
 861    0x01, 0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 862    0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0xff,
 863    0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
 864    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 865static const uint8_t ltc_secp384r1_aCurveParam[48] = {
 866    0xfc, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 867    0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 868    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 869    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 870static const uint8_t ltc_secp384r1_bCurveParam[48] = {
 871    0xef, 0x2a, 0xec, 0xd3, 0xed, 0xc8, 0x85, 0x2a, 0x9d, 0xd1, 0x2e, 0x8a,
 872    0x8d, 0x39, 0x56, 0xc6, 0x5a, 0x87, 0x13, 0x50, 0x8f, 0x08, 0x14, 0x03,
 873    0x12, 0x41, 0x81, 0xfe, 0x6e, 0x9c, 0x1d, 0x18, 0x19, 0x2d, 0xf8, 0xe3,
 874    0x6b, 0x05, 0x8e, 0x98, 0xe4, 0xe7, 0x3e, 0xe2, 0xa7, 0x2f, 0x31, 0xb3};
 875#endif
 876#endif /* ECC384 */
 877
 878static int ltc_get_ecc_specs(const uint8_t **modulus, const uint8_t **r2modn,
 879    const uint8_t **aCurveParam, const uint8_t **bCurveParam, const uint8_t *prime,
 880    int size)
 881{
 882    switch (size) {
 883#ifdef ECC256
 884    case 32:
 885#ifndef NO_ECC_SECP
 886        if (XMEMCMP(prime, ltc_secp256r1_modulus, size) == 0) {
 887            *modulus = ltc_secp256r1_modulus;
 888            *r2modn = ltc_secp256r1_r2modn;
 889            *aCurveParam = ltc_secp256r1_aCurveParam;
 890            *bCurveParam = ltc_secp256r1_bCurveParam;
 891            return 0;
 892        }
 893#endif
 894#ifdef HAVE_ECC_KOBLITZ
 895        if (XMEMCMP(prime, ltc_secp256k1_modulus, size) == 0) {
 896            *modulus = ltc_secp256k1_modulus;
 897            *r2modn = ltc_secp256k1_r2modn;
 898            *aCurveParam = ltc_secp256k1_aCurveParam;
 899            *bCurveParam = ltc_secp256k1_bCurveParam;
 900            return 0;
 901        }
 902#endif
 903        break;
 904#endif /* ECC256 */
 905
 906#ifdef ECC224
 907    case 28:
 908#ifndef NO_ECC_SECP
 909        if (XMEMCMP(prime, ltc_secp224r1_modulus, size) == 0) {
 910            *modulus = ltc_secp224r1_modulus;
 911            *r2modn = ltc_secp224r1_r2modn;
 912            *aCurveParam = ltc_secp224r1_aCurveParam;
 913            *bCurveParam = ltc_secp224r1_bCurveParam;
 914            return 0;
 915        }
 916#endif
 917#ifdef HAVE_ECC_KOBLITZ
 918        if (XMEMCMP(prime, ltc_secp224k1_modulus, size) == 0) {
 919            *modulus = ltc_secp224k1_modulus;
 920            *r2modn = ltc_secp224k1_r2modn;
 921            *aCurveParam = ltc_secp224k1_aCurveParam;
 922            *bCurveParam = ltc_secp224k1_bCurveParam;
 923            return 0;
 924        }
 925#endif
 926        break;
 927#endif /* ECC224 */
 928
 929#ifdef ECC192
 930    case 24:
 931#ifndef NO_ECC_SECP
 932        if (XMEMCMP(prime, ltc_secp192r1_modulus, size) == 0) {
 933            *modulus = ltc_secp192r1_modulus;
 934            *r2modn = ltc_secp192r1_r2modn;
 935            *aCurveParam = ltc_secp192r1_aCurveParam;
 936            *bCurveParam = ltc_secp192r1_bCurveParam;
 937            return 0;
 938        }
 939#endif
 940#ifdef HAVE_ECC_KOBLITZ
 941        if (XMEMCMP(prime, ltc_secp192k1_modulus, size) == 0) {
 942            *modulus = ltc_secp192k1_modulus;
 943            *r2modn = ltc_secp192k1_r2modn;
 944            *aCurveParam = ltc_secp192k1_aCurveParam;
 945            *bCurveParam = ltc_secp192k1_bCurveParam;
 946            return 0;
 947        }
 948#endif
 949        break;
 950#endif /* ECC192 */
 951
 952#ifdef ECC384
 953    case 48:
 954#ifndef NO_ECC_SECP
 955        if (XMEMCMP(prime, ltc_secp384r1_modulus, size) == 0) {
 956            *modulus = ltc_secp384r1_modulus;
 957            *r2modn = ltc_secp384r1_r2modn;
 958            *aCurveParam = ltc_secp384r1_aCurveParam;
 959            *bCurveParam = ltc_secp384r1_bCurveParam;
 960            return 0;
 961        }
 962#endif
 963        break;
 964#endif /* ECC384 */
 965
 966    default:
 967        break;
 968    }
 969
 970    return -1;
 971}
 972
 973/**
 974   Perform a point multiplication  (timing resistant)
 975   k    The scalar to multiply by
 976   G    The base point
 977   R    [out] Destination for kG
 978   modulus  The modulus of the field the ECC curve is in
 979   map      Boolean whether to map back to affine or not
 980            (1==map, 0 == leave in projective)
 981   return MP_OKAY on success
 982*/
 983int wc_ecc_mulmod_ex(const mp_int *k, ecc_point *G, ecc_point *R, mp_int* a,
 984    mp_int *modulus, int map, void* heap)
 985{
 986    ltc_pkha_ecc_point_t B;
 987    uint8_t size;
 988    int szModulus;
 989    int szkbin;
 990    bool point_of_infinity;
 991    status_t status;
 992    int res;
 993
 994    uint8_t Gxbin[LTC_MAX_ECC_BITS / 8];
 995    uint8_t Gybin[LTC_MAX_ECC_BITS / 8];
 996    uint8_t kbin[LTC_MAX_INT_BYTES];
 997
 998    const uint8_t *modbin;
 999    const uint8_t *aCurveParam;
1000    const uint8_t *bCurveParam;
1001    const uint8_t *r2modn;
1002
1003    (void)a;
1004    (void)heap;
1005
1006    if (k == NULL || G == NULL || R == NULL || modulus == NULL) {
1007        return ECC_BAD_ARG_E;
1008    }
1009
1010    szModulus = mp_unsigned_bin_size(modulus);
1011    szkbin = mp_unsigned_bin_size(k);
1012
1013    /* make sure LTC big number variable is large enough */
1014    if (szModulus > LTC_MAX_INT_BYTES / 2) {
1015        return MP_MEM;
1016    }
1017
1018    res = ltc_get_from_mp_int(kbin, (mp_int*)k, szkbin);
1019    if (res == MP_OKAY)
1020        res = ltc_get_from_mp_int(Gxbin, G->x, szModulus);
1021    if (res == MP_OKAY)
1022        res = ltc_get_from_mp_int(Gybin, G->y, szModulus);
1023    if (res != MP_OKAY)
1024        return res;
1025
1026    size = szModulus;
1027
1028    /* find LTC friendly parameters for the selected curve */
1029    if (ltc_get_ecc_specs(&modbin, &r2modn, &aCurveParam, &bCurveParam,
1030                          (const uint8_t *)modulus->dp, size) != 0) {
1031        return ECC_BAD_ARG_E;
1032    }
1033
1034    B.X = &Gxbin[0];
1035    B.Y = &Gybin[0];
1036
1037    status = LTC_PKHA_ECC_PointMul(LTC_BASE, &B, kbin, szkbin, modbin, r2modn,
1038        aCurveParam, bCurveParam, size, kLTC_PKHA_TimingEqualized,
1039        kLTC_PKHA_IntegerArith, &B, &point_of_infinity);
1040    if (status != kStatus_Success) {
1041        return MP_VAL;
1042    }
1043
1044    ltc_reverse_array(Gxbin, size);
1045    ltc_reverse_array(Gybin, size);
1046    res = mp_read_unsigned_bin(R->x, Gxbin, size);
1047    if (res == MP_OKAY) {
1048        res = mp_read_unsigned_bin(R->y, Gybin, size);
1049        /* if k is negative, we compute the multiplication with abs(-k)
1050         * with result (x, y) and modify the result to (x, -y)
1051         */
1052#if (!defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_SP_MATH_ALL)) || \
1053      defined(WOLFSSL_SP_INT_NEGATIVE)
1054        R->y->sign = k->sign;
1055#endif
1056    }
1057    if (res == MP_OKAY)
1058        res = mp_set(R->z, 1);
1059
1060    return res;
1061}
1062
1063int wc_ecc_mulmod_ex2(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
1064                      mp_int* modulus, mp_int* order, WC_RNG* rng, int map,
1065                      void* heap)
1066{
1067    (void)order;
1068    (void)rng;
1069    return wc_ecc_mulmod_ex(k, G, R, a, modulus, map, heap);
1070}
1071
1072int ecc_map_ex(ecc_point* P, mp_int* modulus, mp_digit mp, int ct)
1073{
1074    /* this is handled in hardware, so no projective mapping needed */
1075    (void)P;
1076    (void)modulus;
1077    (void)mp;
1078    (void)ct;
1079    return MP_OKAY;
1080}
1081
1082int wc_ecc_point_add(ecc_point *mG, ecc_point *mQ, ecc_point *mR, mp_int *m)
1083{
1084    int res;
1085    ltc_pkha_ecc_point_t A, B;
1086    int size;
1087    status_t status;
1088
1089    uint8_t Gxbin[LTC_MAX_ECC_BITS / 8];
1090    uint8_t Gybin[LTC_MAX_ECC_BITS / 8];
1091    uint8_t Qxbin[LTC_MAX_ECC_BITS / 8];
1092    uint8_t Qybin[LTC_MAX_ECC_BITS / 8];
1093    const uint8_t *modbin;
1094    const uint8_t *aCurveParam;
1095    const uint8_t *bCurveParam;
1096    const uint8_t *r2modn;
1097
1098    size = mp_unsigned_bin_size(m);
1099
1100    /* find LTC friendly parameters for the selected curve */
1101    if (ltc_get_ecc_specs(&modbin, &r2modn, &aCurveParam, &bCurveParam,
1102                          (const uint8_t *)m->dp, size) != 0) {
1103        res = ECC_BAD_ARG_E;
1104    }
1105    else {
1106        res = ltc_get_from_mp_int(Gxbin, mG->x, size);
1107        if (res == MP_OKAY)
1108            res = ltc_get_from_mp_int(Gybin, mG->y, size);
1109        if (res == MP_OKAY)
1110            res = ltc_get_from_mp_int(Qxbin, mQ->x, size);
1111        if (res == MP_OKAY)
1112            res = ltc_get_from_mp_int(Qybin, mQ->y, size);
1113
1114        if (res != MP_OKAY)
1115            return res;
1116
1117        A.X = Gxbin;
1118        A.Y = Gybin;
1119
1120        B.X = Qxbin;
1121        B.Y = Qybin;
1122
1123        status = LTC_PKHA_ECC_PointAdd(LTC_BASE, &A, &B, modbin, r2modn,
1124            aCurveParam, bCurveParam, size, kLTC_PKHA_IntegerArith, &A);
1125        if (status != kStatus_Success) {
1126            res = MP_VAL;
1127        }
1128        else {
1129            ltc_reverse_array(Gxbin, size);
1130            ltc_reverse_array(Gybin, size);
1131            res = mp_read_unsigned_bin(mR->x, Gxbin, size);
1132            if (res == MP_OKAY)
1133                res = mp_read_unsigned_bin(mR->y, Gybin, size);
1134            if (res == MP_OKAY)
1135                res = mp_set(mR->z, 1);
1136        }
1137    }
1138    return res;
1139}
1140
1141#if defined(HAVE_ED25519) || defined(HAVE_CURVE25519)
1142/* Weierstrass parameters of prime 2^255 - 19 */
1143static const uint8_t curve25519_modbin[32] = {
1144    0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1145    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1146    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f};
1147/* precomputed R2modN for the curve25519 */
1148static const uint8_t r2mod[32] = {
1149    0xa4, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1150    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1151    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
1152
1153/* invThree = ModInv(3,curve25519_modbin) in LSB first */
1154static const uint8_t invThree[32] = {
1155    0x49, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
1156    0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
1157    0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55};
1158
1159/*
1160 *
1161 * finds square root in finite field when modulus congruent to 5 modulo 8
1162 * this is fixed to curve25519 modulus 2^255 - 19 which is congruent to
1163 * 5 modulo 8.
1164 *
1165 * This function solves equation: res^2 = a mod (2^255 - 19)
1166 *
1167p = prime
1168p % 8 must be 5
1169
1170v = ModularArithmetic.powmod(2*a, (p-5)/8, p)
1171i = (2*a*v**2) % p
1172r1 = 1*a*v*(i - 1) % p
1173r2 = -1*a*v*(i - 1) % p
1174puts "Gy=0x#{r2.to_s(16)}"
1175 */
1176status_t LTC_PKHA_Prime25519SquareRootMod(const uint8_t *A, size_t sizeA,
1177    uint8_t *res, size_t *szRes, int sign)
1178{
1179    status_t status;
1180    const uint8_t curve25519_param[] = {
1181        0xfd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1182        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1183        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0f};
1184    uint8_t twoA[sizeof(curve25519_modbin)] = {0};
1185    uint8_t V[sizeof(curve25519_modbin)] = {0};
1186    uint8_t I[sizeof(curve25519_modbin)] = {0};
1187    uint8_t VV[sizeof(curve25519_modbin)] = {0};
1188    uint16_t szTwoA = 0;
1189    uint16_t szV = 0;
1190    uint16_t szVV = 0;
1191    uint16_t szI = 0;
1192    uint16_t szRes16 = 0;
1193    uint8_t one = 1;
1194
1195    /* twoA = 2*A % p */
1196    status = LTC_PKHA_ModAdd(LTC_BASE, A, sizeA, A, sizeA, curve25519_modbin,
1197        sizeof(curve25519_modbin), twoA, &szTwoA, kLTC_PKHA_IntegerArith);
1198
1199    /* V = ModularArithmetic.powmod(twoA, (p-5)/8, p) */
1200    if (status == kStatus_Success) {
1201        status =
1202            LTC_PKHA_ModExp(LTC_BASE, twoA, szTwoA, curve25519_modbin,
1203                sizeof(curve25519_modbin), curve25519_param,
1204                sizeof(curve25519_param), V, &szV, kLTC_PKHA_IntegerArith,
1205                kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1206    }
1207
1208    /* VV = V*V % p */
1209    if (status == kStatus_Success) {
1210        status = LTC_PKHA_ModMul(LTC_BASE, V, szV, V, szV, curve25519_modbin,
1211            sizeof(curve25519_modbin), VV, &szVV, kLTC_PKHA_IntegerArith,
1212            kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1213            kLTC_PKHA_TimingEqualized);
1214    }
1215
1216    /* I = twoA * VV = 2*A*V*V % p */
1217    if (status == kStatus_Success) {
1218        status = LTC_PKHA_ModMul(LTC_BASE, twoA, szTwoA, VV, szVV,
1219            curve25519_modbin, sizeof(curve25519_modbin), I, &szI,
1220            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1221            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1222    }
1223
1224    /* I = I - 1 */
1225    /* just temp for maximum integer - for non-modular subtract */
1226    XMEMSET(VV, 0xff, sizeof(VV));
1227    if (LTC_PKHA_CompareBigNum(I, szI, &one, sizeof(one)) >= 0) {
1228        if (status == kStatus_Success) {
1229            status = LTC_PKHA_ModSub1(LTC_BASE, I, szI, &one, sizeof(one),
1230                VV, sizeof(VV), I, &szI);
1231        }
1232    }
1233    else {
1234        if (status == kStatus_Success) {
1235            status = LTC_PKHA_ModSub1(LTC_BASE, curve25519_modbin,
1236                sizeof(curve25519_modbin), &one, sizeof(one), VV, sizeof(VV), I,
1237                &szI);
1238        }
1239    }
1240
1241    /* res = a*v  mod p */
1242    status = LTC_PKHA_ModMul(LTC_BASE, A, sizeA, V, szV, curve25519_modbin,
1243        sizeof(curve25519_modbin), res, &szRes16, kLTC_PKHA_IntegerArith,
1244        kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1245        kLTC_PKHA_TimingEqualized);
1246
1247    /* res = res * (i-1) mod p */
1248    if (status == kStatus_Success) {
1249        status = LTC_PKHA_ModMul(LTC_BASE, res, szRes16, I, szI,
1250            curve25519_modbin, sizeof(curve25519_modbin), res, &szRes16,
1251            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1252            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1253    }
1254
1255    /* if X mod 2 != X_0 then we need the -X
1256     *
1257     * X mod 2 get from LSB bit0
1258     */
1259    if ((status == kStatus_Success) &&
1260        ((bool)sign != (bool)(res[0] & 0x01u)))
1261    {
1262        status = LTC_PKHA_ModSub1(LTC_BASE, curve25519_modbin,
1263            sizeof(curve25519_modbin), res, szRes16, VV, sizeof(VV), res,
1264            &szRes16); /* -a = p - a */
1265    }
1266
1267    if (status == kStatus_Success) {
1268        *szRes = szRes16;
1269    }
1270
1271    return status;
1272}
1273#endif /* HAVE_ED25519 || HAVE_CURVE25519 */
1274
1275
1276#ifdef HAVE_CURVE25519
1277
1278/* for LTC we need Weierstrass format of curve25519 parameters
1279         * these two are base point X and Y.
1280         * in LSB first format (native for LTC)
1281         */
1282static const ECPoint ecBasePoint = {
1283   {0x5a, 0x24, 0xad, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1284    0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1285    0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2a},
1286   {0xd9, 0xd3, 0xce, 0x7e, 0xa2, 0xc5, 0xe9, 0x29, 0xb2, 0x61, 0x7c,
1287    0x6d, 0x7e, 0x4d, 0x3d, 0x92, 0x4c, 0xd1, 0x48, 0x77, 0x2c, 0xdd,
1288    0x1e, 0xe0, 0xb4, 0x86, 0xa0, 0xb8, 0xa1, 0x19, 0xae, 0x20},
1289};
1290
1291const ECPoint *nxp_ltc_curve25519_GetBasePoint(void)
1292{
1293    return &ecBasePoint;
1294}
1295
1296static const uint8_t curve25519_aCurveParam[CURVE25519_KEYSIZE] = {
1297    0x44, 0xa1, 0x14, 0x49, 0x98, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1298    0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1299    0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1300    0xaa, 0xaa, 0xaa, 0xaa, 0x2a};
1301
1302static const uint8_t curve25519_bCurveParam[CURVE25519_KEYSIZE] = {
1303    0x64, 0xc8, 0x10, 0x77, 0x9c, 0x5e, 0x0b, 0x26, 0xb4, 0x97, 0xd0,
1304    0x5e, 0x42, 0x7b, 0x09, 0xed,
1305    0x25, 0xb4, 0x97, 0xd0, 0x5e, 0x42, 0x7b, 0x09, 0xed, 0x25, 0xb4,
1306    0x97, 0xd0, 0x5e, 0x42, 0x7b};
1307
1308/* transform a point on Montgomery curve to a point on Weierstrass curve */
1309status_t LTC_PKHA_Curve25519ToWeierstrass(
1310    const ltc_pkha_ecc_point_t *ltcPointIn,ltc_pkha_ecc_point_t *ltcPointOut)
1311{
1312    /* offset X point (in Montgomery) so that it becomes Weierstrass */
1313    const uint8_t offset[] = {
1314        0x51, 0x24, 0xad, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1315        0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
1316        0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2a};
1317    uint16_t sizeRes = 0;
1318    status_t status;
1319    status = LTC_PKHA_ModAdd(LTC_BASE, ltcPointIn->X, CURVE25519_KEYSIZE,
1320        offset, sizeof(offset), curve25519_modbin, CURVE25519_KEYSIZE,
1321        ltcPointOut->X, &sizeRes, kLTC_PKHA_IntegerArith);
1322
1323    if (status == kStatus_Success) {
1324        if (ltcPointOut->Y != ltcPointIn->Y) {
1325            XMEMCPY(ltcPointOut->Y, ltcPointIn->Y, CURVE25519_KEYSIZE);
1326        }
1327    }
1328
1329    return status;
1330}
1331
1332/* transform a point on Weierstrass curve to a point on Montgomery curve */
1333status_t LTC_PKHA_WeierstrassToCurve25519(
1334    const ltc_pkha_ecc_point_t *ltcPointIn, ltc_pkha_ecc_point_t *ltcPointOut)
1335{
1336    status_t status;
1337    uint16_t resultSize = 0;
1338    const uint8_t three = 0x03;
1339
1340    status = LTC_PKHA_ModMul(LTC_BASE, &three, sizeof(three), ltcPointIn->X,
1341        CURVE25519_KEYSIZE, curve25519_modbin, CURVE25519_KEYSIZE,
1342        ltcPointOut->X, &resultSize, kLTC_PKHA_IntegerArith,
1343        kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1344        kLTC_PKHA_TimingEqualized);
1345
1346    if (status == kStatus_Success) {
1347        const uint8_t A[] = {0x06, 0x6d, 0x07};
1348        if (LTC_PKHA_CompareBigNum(ltcPointOut->X, resultSize, A, sizeof(A))) {
1349            status = LTC_PKHA_ModSub1(LTC_BASE, ltcPointOut->X, resultSize, A,
1350                sizeof(A), curve25519_modbin, CURVE25519_KEYSIZE,
1351                ltcPointOut->X, &resultSize);
1352        }
1353        else {
1354            status = LTC_PKHA_ModSub2(LTC_BASE, ltcPointOut->X, resultSize, A,
1355                sizeof(A), curve25519_modbin, CURVE25519_KEYSIZE,
1356                ltcPointOut->X, &resultSize);
1357        }
1358    }
1359
1360    if (status == kStatus_Success) {
1361        status = LTC_PKHA_ModMul(LTC_BASE, invThree, CURVE25519_KEYSIZE,
1362            ltcPointOut->X, resultSize, curve25519_modbin, CURVE25519_KEYSIZE,
1363            ltcPointOut->X, &resultSize, kLTC_PKHA_IntegerArith,
1364            kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1365            kLTC_PKHA_TimingEqualized);
1366    }
1367
1368    if (status == kStatus_Success) {
1369        if (ltcPointOut->Y != ltcPointIn->Y) {
1370            XMEMCPY(ltcPointOut->Y, ltcPointIn->Y, CURVE25519_KEYSIZE);
1371        }
1372    }
1373
1374    return status;
1375}
1376
1377/* Y = square root (X^3 + 486662*X^2 + X) */
1378status_t LTC_PKHA_Curve25519ComputeY(ltc_pkha_ecc_point_t *ltcPoint)
1379{
1380    uint8_t three = 3;
1381    const uint8_t A[] = {0x06, 0x6d, 0x07};
1382    uint8_t U[CURVE25519_KEYSIZE] = {0};
1383    uint8_t X2[CURVE25519_KEYSIZE] = {0};
1384    uint16_t sizeU = 0;
1385    uint16_t sizeX2 = 0;
1386    size_t szRes = 0;
1387    status_t status;
1388
1389    /* X^3 */
1390    status = LTC_PKHA_ModExp(LTC_BASE, ltcPoint->X, CURVE25519_KEYSIZE,
1391        curve25519_modbin, CURVE25519_KEYSIZE, &three, 1, U, &sizeU,
1392        kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1393        kLTC_PKHA_TimingEqualized);
1394
1395    /* X^2 */
1396    if (status == kStatus_Success) {
1397        status = LTC_PKHA_ModMul(LTC_BASE, ltcPoint->X, CURVE25519_KEYSIZE,
1398            ltcPoint->X, CURVE25519_KEYSIZE, curve25519_modbin,
1399            CURVE25519_KEYSIZE, X2, &sizeX2, kLTC_PKHA_IntegerArith,
1400            kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1401            kLTC_PKHA_TimingEqualized);
1402    }
1403
1404    /* 486662*X^2 */
1405    if (status == kStatus_Success) {
1406        status = LTC_PKHA_ModMul(LTC_BASE, A, sizeof(A), X2, sizeX2,
1407            curve25519_modbin, CURVE25519_KEYSIZE, X2, &sizeX2,
1408            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1409            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1410    }
1411
1412    /* X^3 + 486662*X^2 */
1413    if (status == kStatus_Success) {
1414        status = LTC_PKHA_ModAdd(LTC_BASE, U, sizeU, X2, sizeX2,
1415            curve25519_modbin, CURVE25519_KEYSIZE, U, &sizeU,
1416            kLTC_PKHA_IntegerArith);
1417    }
1418
1419    /* U = X^3 + 486662*X^2 + X */
1420    if (status == kStatus_Success) {
1421        status = LTC_PKHA_ModAdd(LTC_BASE, U, sizeU, ltcPoint->X,
1422            CURVE25519_KEYSIZE, curve25519_modbin, CURVE25519_KEYSIZE, U,
1423            &sizeU, kLTC_PKHA_IntegerArith);
1424    }
1425
1426    /* Y = modular square root of U (U is Y^2) */
1427    if (status == kStatus_Success) {
1428        status = LTC_PKHA_Prime25519SquareRootMod(U, sizeU, ltcPoint->Y,
1429            &szRes, 1);
1430    }
1431
1432    return status;
1433}
1434
1435/* Q = n*P */
1436/* if type is set, the input point p is in Montgomery curve coordinates,
1437    so there is a map to Weierstrass curve */
1438/* q output point is always in Montgomery curve coordinates */
1439int nxp_ltc_curve25519(ECPoint *q, const byte *n, const ECPoint *p,
1440    fsl_ltc_ecc_coordinate_system_t type)
1441{
1442    status_t status;
1443    ltc_pkha_ecc_point_t ltcPoint;
1444    ltc_pkha_ecc_point_t ltcPointOut;
1445    ECPoint pIn = {{0}};
1446
1447    XMEMCPY(&pIn, p, sizeof(*p));
1448    ltcPoint.X = &pIn.point[0];
1449    ltcPoint.Y = &pIn.pointY[0];
1450
1451    /* if input point P is on Curve25519 Montgomery curve, transform
1452        it to Weierstrass equivalent */
1453    if (type == kLTC_Curve25519) {
1454        LTC_PKHA_Curve25519ToWeierstrass(&ltcPoint, &ltcPoint);
1455    }
1456
1457    ltcPointOut.X = &q->point[0];
1458    ltcPointOut.Y = &q->pointY[0];
1459    /* curve25519_modbin, r2mod, curve25519_aCurveParam, curve25519_bCurveParam
1460     * are Weierstrass equivalent with Curve25519 */
1461    status = LTC_PKHA_ECC_PointMul(LTC_BASE, &ltcPoint, n, CURVE25519_KEYSIZE,
1462        curve25519_modbin, r2mod, curve25519_aCurveParam,
1463        curve25519_bCurveParam, CURVE25519_KEYSIZE, kLTC_PKHA_TimingEqualized,
1464        kLTC_PKHA_IntegerArith, &ltcPointOut, NULL);
1465
1466    /* now need to map from Weierstrass form to Montgomery form */
1467    if (status == kStatus_Success) {
1468        status = LTC_PKHA_WeierstrassToCurve25519(&ltcPointOut, &ltcPointOut);
1469    }
1470
1471    return (status == kStatus_Success) ? 0 : IS_POINT_E;
1472}
1473
1474#endif /* HAVE_CURVE25519 */
1475
1476
1477#ifdef HAVE_ED25519
1478/* a and d are Edwards curve parameters -1 and -121665/121666 prime is 2^255 - 19.
1479 *
1480 * https://en.wikipedia.org/wiki/Montgomery_curve#Equivalence_with_Edward_curves
1481 */
1482
1483/* d parameter of ed25519 */
1484static const uint8_t d_coefEd25519[] = {
1485    0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75, 0xab, 0xd8, 0x41,
1486    0x41, 0x4d, 0x0a, 0x70, 0x00, 0x98, 0xe8, 0x79, 0x77, 0x79, 0x40,
1487    0xc7, 0x8c, 0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52};
1488
1489/* Montgomery curve parameter A for a Montgomery curve equivalent with ed25519 */
1490static const uint8_t A_coefEd25519[] = {
1491    0x06, 0x6d, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1492    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1493    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
1494
1495/* Montgomery curve parameter B for a Montgomery curve equivalent with ed25519 */
1496static const uint8_t B_coefEd25519[] = {
1497    0xe5, 0x92, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1498    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1499    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f};
1500
1501/* these are pre-computed constants used in computations */
1502
1503/* = 3*B */
1504static const uint8_t threeB_coefEd25519[] = {
1505    0xd5, 0xb8, 0xe9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1506    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1507    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f};
1508
1509/* = -A */
1510static const uint8_t minus_A_coefEd25519[] = {
1511    0xe7, 0x92, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1512    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1513    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f};
1514
1515/* = 1/B */
1516static const uint8_t invB_coefEd25519[] = {
15170xc4, 0xa1, 0x29, 0x7b, 0x8d, 0x2c, 0x85, 0x22, 0xd5, 0x89, 0xaf,
1518    0xaf, 0x6c, 0xfd, 0xe3, 0xff, 0xd9, 0x85, 0x21, 0xa2, 0xe1, 0x2f,
1519    0xce, 0x1c, 0x63, 0x00, 0x24, 0x75, 0xc4, 0x24, 0x7f, 0x6b};
1520
1521/* = 1/(3*B) */
1522static const uint8_t A_mul_invThreeB_coefEd25519[] = {
1523    0xb9, 0x3e, 0xe4, 0xad, 0xa1, 0x37, 0xa7, 0x93, 0x1c, 0xa4, 0x35,
1524    0xe0, 0x0c, 0x57, 0xbd, 0xaa, 0x6e, 0x51, 0x94, 0x3e, 0x14, 0xe0,
1525    0xcb, 0xec, 0xbd, 0xff, 0xe7, 0xb1, 0x27, 0x92, 0x00, 0x63};
1526
1527/* Weierstrass curve parameter a for a Weierstrass curve equivalent with ed25519 */
1528static const uint8_t a_coefEd25519[] = {
1529    0x2d, 0x17, 0xbc, 0xf8, 0x8e, 0xe1, 0x71, 0xac, 0xf7, 0x2a, 0xa5,
1530    0x0c, 0x5d, 0xb6, 0xb8, 0x6b, 0xd6, 0x3d, 0x7b, 0x61, 0x0d, 0xe1,
1531    0x97, 0x31, 0xe6, 0xbe, 0xb9, 0xa5, 0xd3, 0xac, 0x4e, 0x5d};
1532
1533/* Weierstrass curve parameter b for a Weierstrass curve equivalent with ed25519 */
1534static const uint8_t b_coefEd25519[] = {
1535    0xa4, 0xb2, 0x64, 0xf3, 0xc1, 0xeb, 0x04, 0x90, 0x32, 0xbc, 0x9f,
1536    0x6b, 0x97, 0x31, 0x48, 0xf5, 0xd5, 0x80, 0x57, 0x10, 0x06, 0xdb,
1537    0x0d, 0x55, 0xe0, 0xb3, 0xd0, 0xcf, 0x9b, 0xb2, 0x11, 0x1d};
1538
1539/* Ed25519 basepoint B mapped to Weierstrass equivalent */
1540static uint8_t Wx_Ed25519[ED25519_KEY_SIZE] = {
1541    0x35, 0xef, 0x5a, 0x02, 0x9b, 0xc8, 0x55, 0xca, 0x9a, 0x7c, 0x61,
1542    0x0d, 0xdf, 0x3f, 0xc1, 0xa9, 0x18, 0x06, 0xc2, 0xf1, 0x02, 0x8f,
1543    0x0b, 0xf0, 0x39, 0x03, 0x2c, 0xd0, 0x0f, 0xdd, 0x78, 0x2a};
1544static uint8_t Wy_Ed25519[ED25519_KEY_SIZE] = {
1545    0x14, 0x1d, 0x2c, 0xf6, 0xf3, 0x30, 0x78, 0x9b, 0x65, 0x31, 0x71,
1546    0x80, 0x61, 0xd0, 0x6f, 0xcf, 0x23, 0x83, 0x79, 0x63, 0xa5, 0x3b,
1547    0x48, 0xbe, 0x2e, 0xa2, 0x1d, 0xc7, 0xa5, 0x44, 0xc6, 0x29};
1548
1549static const ltc_pkha_ecc_point_t basepointEd25519 = {
1550    Wx_Ed25519, Wy_Ed25519,
1551};
1552
1553const ltc_pkha_ecc_point_t *LTC_PKHA_Ed25519_BasePoint(void)
1554{
1555    return &basepointEd25519;
1556}
1557
1558/* input point is on Weierstrass curve, typeOut determines the coordinates
1559    system of output point (either Weierstrass or Ed25519) */
1560status_t LTC_PKHA_Ed25519_PointMul(const ltc_pkha_ecc_point_t *ltcPointIn,
1561                                   const uint8_t *N,
1562                                   size_t sizeN,
1563                                   ltc_pkha_ecc_point_t *ltcPointOut,
1564                                   fsl_ltc_ecc_coordinate_system_t typeOut)
1565{
1566    uint16_t szN = (uint16_t)sizeN;
1567    status_t status;
1568    /* input on W, output in W, W parameters of ECC curve are Ed25519 curve
1569        parameters mapped to Weierstrass curve */
1570    status = LTC_PKHA_ECC_PointMul(LTC_BASE, ltcPointIn, N, szN,
1571        curve25519_modbin, r2mod, a_coefEd25519, b_coefEd25519,
1572        ED25519_KEY_SIZE, kLTC_PKHA_TimingEqualized, kLTC_PKHA_IntegerArith,
1573        ltcPointOut, NULL);
1574
1575    /* Weierstrass coordinates to Ed25519 coordinates */
1576    if ((status == kStatus_Success) && (typeOut == kLTC_Ed25519)) {
1577        status = LTC_PKHA_WeierstrassToEd25519(ltcPointOut, ltcPointOut);
1578    }
1579    return status;
1580}
1581
1582status_t LTC_PKHA_Ed25519ToWeierstrass(const ltc_pkha_ecc_point_t *ltcPointIn,
1583    ltc_pkha_ecc_point_t *ltcPointOut)
1584{
1585    status_t status;
1586    uint8_t Mx[ED25519_KEY_SIZE] = {0};
1587    uint8_t My[ED25519_KEY_SIZE] = {0};
1588    uint8_t temp[ED25519_KEY_SIZE] = {0};
1589    uint8_t temp2[ED25519_KEY_SIZE] = {0};
1590    const uint8_t max[32] = {
1591        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1592        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1593        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
1594    const uint8_t *Ex;
1595    const uint8_t *Ey;
1596    uint8_t *Gx;
1597    uint8_t *Gy;
1598    uint16_t szMx = 0;
1599    uint16_t szGx = 0;
1600    uint16_t szMy = 0;
1601    uint16_t szGy = 0;
1602    uint16_t szTemp = 0;
1603    uint16_t szTemp2 = 0;
1604    uint8_t one = 1;
1605
1606    Ex = ltcPointIn->X;
1607    Ey = ltcPointIn->Y;
1608    Gx = ltcPointOut->X;
1609    Gy = ltcPointOut->Y;
1610    /* # (Ex, Ey) on Ed (a_ed, d) to (x, y) on M (A,B)
1611    Mx = (1 + Ey) * ModularArithmetic.invert(1 - Ey, prime) % prime
1612    My = (1 + Ey) * ModularArithmetic.invert((1 - Ey)*Ex, prime) % prime */
1613
1614    /* Gx = ((Mx * ModularArithmetic.invert(B, prime)) +
1615        (A * ModularArithmetic.invert(3*B, prime))) % prime
1616    Gy = (My * ModularArithmetic.invert(B, prime)) % prime */
1617
1618    /* temp = 1 + Ey */
1619    status = LTC_PKHA_ModAdd(LTC_BASE, Ey, ED25519_KEY_SIZE, &one, sizeof(one),
1620        curve25519_modbin, sizeof(curve25519_modbin), temp, &szTemp,
1621        kLTC_PKHA_IntegerArith);
1622
1623    /* temp2 = 1 - Ey = 1 + (p - Ey) */
1624    if (status == kStatus_Success) {
1625        status = LTC_PKHA_ModSub1(LTC_BASE, curve25519_modbin,
1626            sizeof(curve25519_modbin), Ey, ED25519_KEY_SIZE, max, sizeof(max),
1627            temp2, &szTemp2);
1628    }
1629    if (status == kStatus_Success) {
1630        status = LTC_PKHA_ModAdd(LTC_BASE, temp2, szTemp2, &one, sizeof(one),
1631            curve25519_modbin, sizeof(curve25519_modbin), temp2, &szTemp2,
1632            kLTC_PKHA_IntegerArith);
1633    }
1634
1635    /* Mx = ModInv(temp2,prime) */
1636    if (status == kStatus_Success) {
1637        status = LTC_PKHA_ModInv(LTC_BASE, temp2, szTemp2, curve25519_modbin,
1638            sizeof(curve25519_modbin), Mx, &szMx, kLTC_PKHA_IntegerArith);
1639    }
1640
1641    /* Mx = Mx * temp */
1642    if (status == kStatus_Success) {
1643        status = LTC_PKHA_ModMul(LTC_BASE, Mx, szMx, temp, szTemp,
1644            curve25519_modbin, ED25519_KEY_SIZE, Mx, &szMx,
1645            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1646            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1647    }
1648
1649    /* My = temp2 * Ex */
1650    if (status == kStatus_Success) {
1651        status = LTC_PKHA_ModMul(LTC_BASE, Ex, ED25519_KEY_SIZE, temp2,
1652            szTemp2, curve25519_modbin, ED25519_KEY_SIZE, My, &szMy,
1653            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1654            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1655    }
1656
1657    /* My = ModInv(My, prime) */
1658    if (status == kStatus_Success) {
1659        status = LTC_PKHA_ModInv(LTC_BASE, My, szMy, curve25519_modbin,
1660            sizeof(curve25519_modbin), My, &szMy, kLTC_PKHA_IntegerArith);
1661    }
1662    /* My = My * temp */
1663    if (status == kStatus_Success) {
1664        status = LTC_PKHA_ModMul(LTC_BASE, My, szMy, temp, szTemp,
1665            curve25519_modbin, ED25519_KEY_SIZE, My, &szMy,
1666            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1667            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1668    }
1669
1670    /* Gx = Mx * invB_coefEd25519 + A_mul_invThreeB_coefEd25519 */
1671    if (status == kStatus_Success) {
1672        status = LTC_PKHA_ModMul(LTC_BASE, Mx, szMx, invB_coefEd25519,
1673            sizeof(invB_coefEd25519), curve25519_modbin, ED25519_KEY_SIZE, Gx,
1674            &szGx, kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1675            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1676    }
1677    if (status == kStatus_Success) {
1678        status = LTC_PKHA_ModAdd(LTC_BASE, Gx, szGx,
1679            A_mul_invThreeB_coefEd25519, sizeof(A_mul_invThreeB_coefEd25519),
1680            curve25519_modbin, sizeof(curve25519_modbin), Gx, &szGx,
1681            kLTC_PKHA_IntegerArith);
1682    }
1683
1684    /* Gy = My * invB_coefEd25519 */
1685    if (status == kStatus_Success) {
1686        status = LTC_PKHA_ModMul(LTC_BASE, My, szMy, invB_coefEd25519,
1687            sizeof(invB_coefEd25519), curve25519_modbin, ED25519_KEY_SIZE, Gy,
1688            &szGy, kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1689            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1690    }
1691
1692    return status;
1693}
1694
1695/*
1696# (Gx, Gy) on W to (Ex, Ey) on E
1697My = (B*Gy) % prime
1698Mx = ((3*B*Gx-A)*ModularArithmetic.invert(3, prime)) % prime
1699Ex = Mx*ModularArithmetic.invert(My, prime) % prime
1700Ey = (Mx - 1)*ModularArithmetic.invert(Mx + 1, prime) % prime
1701*/
1702status_t LTC_PKHA_WeierstrassToEd25519(const ltc_pkha_ecc_point_t *ltcPointIn,
1703    ltc_pkha_ecc_point_t *ltcPointOut)
1704{
1705    status_t status;
1706    uint8_t Mx[ED25519_KEY_SIZE] = {0};
1707    uint8_t My[ED25519_KEY_SIZE] = {0};
1708    uint8_t temp[ED25519_KEY_SIZE] = {0};
1709    const uint8_t *Gx;
1710    const uint8_t *Gy;
1711    uint8_t *Ex;
1712    uint8_t *Ey;
1713    uint16_t szMx = 0;
1714    uint16_t szEx = 0;
1715    uint16_t szMy = 0;
1716    uint16_t szEy = 0;
1717    uint16_t szTemp = 0;
1718    uint8_t one = 1;
1719
1720    Gx = ltcPointIn->X;
1721    Gy = ltcPointIn->Y;
1722    Ex = ltcPointOut->X;
1723    Ey = ltcPointOut->Y;
1724
1725    /* My = (B*Gy) % prime  */
1726    status = LTC_PKHA_ModMul(LTC_BASE, B_coefEd25519, sizeof(B_coefEd25519),
1727        Gy, ED25519_KEY_SIZE, curve25519_modbin, ED25519_KEY_SIZE, My, &szMy,
1728        kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1729        kLTC_PKHA_TimingEqualized);
1730
1731    /* temp = 3*B*Gx mod p */
1732    if (status == kStatus_Success) {
1733        status = LTC_PKHA_ModMul(LTC_BASE, threeB_coefEd25519,
1734            sizeof(threeB_coefEd25519), Gx, ED25519_KEY_SIZE, curve25519_modbin,
1735            ED25519_KEY_SIZE, temp, &szTemp, kLTC_PKHA_IntegerArith,
1736            kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1737            kLTC_PKHA_TimingEqualized);
1738    }
1739    /* temp = (temp - A) mod p */
1740    if (status == kStatus_Success) {
1741        status = LTC_PKHA_ModAdd(LTC_BASE, temp, szTemp, minus_A_coefEd25519,
1742            sizeof(minus_A_coefEd25519), curve25519_modbin,
1743            sizeof(curve25519_modbin), temp, &szTemp, kLTC_PKHA_IntegerArith);
1744    }
1745    /* Mx = (temp/3) mod p */
1746    if (status == kStatus_Success) {
1747        status = LTC_PKHA_ModMul(LTC_BASE, temp, szTemp, invThree,
1748            sizeof(invThree), curve25519_modbin, sizeof(curve25519_modbin), Mx,
1749             &szMx, kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1750             kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1751    }
1752    /* temp = 1/My mod p */
1753    if (status == kStatus_Success) {
1754        status = LTC_PKHA_ModInv(LTC_BASE, My, szMy, curve25519_modbin,
1755            sizeof(curve25519_modbin), temp, &szTemp, kLTC_PKHA_IntegerArith);
1756    }
1757    /* Ex = Mx * temp mod p */
1758    if (status == kStatus_Success) {
1759        status = LTC_PKHA_ModMul(LTC_BASE, temp, szTemp, Mx, szMx,
1760            curve25519_modbin, sizeof(curve25519_modbin), Ex, &szEx,
1761            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1762            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1763    }
1764
1765    /* temp = Mx + 1 mod p */
1766    if (status == kStatus_Success) {
1767        status = LTC_PKHA_ModAdd(LTC_BASE, Mx, szMx, &one, sizeof(one),
1768            curve25519_modbin, sizeof(curve25519_modbin), temp, &szTemp,
1769            kLTC_PKHA_IntegerArith);
1770    }
1771    /* temp = 1/temp mod p */
1772    if (status == kStatus_Success) {
1773        status = LTC_PKHA_ModInv(LTC_BASE, temp, szTemp, curve25519_modbin,
1774            sizeof(curve25519_modbin), temp, &szTemp, kLTC_PKHA_IntegerArith);
1775    }
1776    /* Mx = (Mx - 1) mod p */
1777    if (status == kStatus_Success) {
1778        if (LTC_PKHA_CompareBigNum(Mx, szMx, &one, sizeof(one)) >= 0) {
1779            status = LTC_PKHA_ModSub1(LTC_BASE, Mx, szMx, &one, sizeof(one),
1780                curve25519_modbin, sizeof(curve25519_modbin), Mx, &szMx);
1781        }
1782        else {
1783            /* Mx is zero, so it is modulus, thus we do modulus - 1 */
1784            XMEMCPY(Mx, curve25519_modbin, sizeof(curve25519_modbin));
1785            Mx[0]--;
1786        }
1787    }
1788    /* Ey = Mx * temp mod p */
1789    if (status == kStatus_Success) {
1790        status = LTC_PKHA_ModMul(LTC_BASE, temp, szTemp, Mx, szMx,
1791            curve25519_modbin, sizeof(curve25519_modbin), Ey, &szEy,
1792            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1793            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1794    }
1795
1796    return status;
1797}
1798
1799status_t LTC_PKHA_Ed25519_PointDecompress(const uint8_t *pubkey,
1800    size_t pubKeySize, ltc_pkha_ecc_point_t *ltcPointOut)
1801{
1802    status_t status;
1803    const uint8_t one = 1;
1804
1805    /* pubkey contains the Y coordinate and a sign of X
1806     */
1807
1808    /* x^2 = ((y^2 - 1) / (d*y^2 +1)) mod p */
1809
1810    /* decode Y from pubkey */
1811    XMEMCPY(ltcPointOut->Y, pubkey, pubKeySize);
1812    ltcPointOut->Y[pubKeySize - 1] &= ~0x80u;
1813    int sign = (int)(bool)(pubkey[pubKeySize - 1] & 0x80u);
1814
1815    uint8_t U[ED25519_KEY_SIZE] = {0};
1816    uint8_t V[ED25519_KEY_SIZE] = {0};
1817    uint8_t *X = ltcPointOut->X;
1818    uint8_t *Y = ltcPointOut->Y;
1819    uint16_t szU = 0;
1820    uint16_t szV = 0;
1821    size_t szRes = 0;
1822
1823    /* decode X from pubkey */
1824
1825    /* U = y * y mod p */
1826    status = LTC_PKHA_ModMul(LTC_BASE, Y, ED25519_KEY_SIZE, Y,
1827        ED25519_KEY_SIZE, curve25519_modbin, ED25519_KEY_SIZE, U, &szU,
1828        kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1829        kLTC_PKHA_TimingEqualized);
1830    XMEMCPY(V, U, szU);
1831    szV = szU;
1832
1833    /* U = U - 1 = y^2 - 1 */
1834    if (status == kStatus_Success) {
1835        if (LTC_PKHA_CompareBigNum(U, szU, &one, sizeof(one)) >= 0) {
1836            status = LTC_PKHA_ModSub1(LTC_BASE, U, szU, &one, sizeof(one),
1837                curve25519_modbin, sizeof(curve25519_modbin), U, &szU);
1838        }
1839        else {
1840            /* U is zero, so it is modulus, thus we do modulus - 1 */
1841            XMEMCPY(U, curve25519_modbin, sizeof(curve25519_modbin));
1842            U[0]--;
1843        }
1844    }
1845
1846    /* V = d*y*y + 1 */
1847    if (status == kStatus_Success) {
1848        status = LTC_PKHA_ModMul(LTC_BASE, V, szV, d_coefEd25519,
1849            ED25519_KEY_SIZE, curve25519_modbin, ED25519_KEY_SIZE, V, &szV,
1850            kLTC_PKHA_IntegerArith, kLTC_PKHA_NormalValue,
1851            kLTC_PKHA_NormalValue, kLTC_PKHA_TimingEqualized);
1852    }
1853
1854    if (status == kStatus_Success) {
1855        status = LTC_PKHA_ModAdd(LTC_BASE, V, szV, &one, sizeof(one),
1856            curve25519_modbin, sizeof(curve25519_modbin), V, &szV,
1857            kLTC_PKHA_IntegerArith);
1858    }
1859
1860    /* U = U / V (mod p) */
1861    if (status == kStatus_Success) {
1862        status = LTC_PKHA_ModInv(LTC_BASE, V, szV, curve25519_modbin,
1863            sizeof(curve25519_modbin), V, &szV, kLTC_PKHA_IntegerArith);
1864    }
1865    if (status == kStatus_Success) {
1866        status = LTC_PKHA_ModMul(LTC_BASE, V, szV, U, szU, curve25519_modbin,
1867            ED25519_KEY_SIZE, U, &szU, kLTC_PKHA_IntegerArith,
1868            kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1869            kLTC_PKHA_TimingEqualized);
1870    }
1871
1872    /* get square root */
1873    if (status == kStatus_Success) {
1874        status = LTC_PKHA_Prime25519SquareRootMod(U, szU, X, &szRes, sign);
1875    }
1876
1877    return status;
1878}
1879
1880/* LSByte first of Ed25519 parameter l = 2^252 +
1881 *   27742317777372353535851937790883648493 */
1882static const uint8_t l_coefEdDSA[] = {
1883    0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7,
1884    0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1885    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10};
1886
1887/*
1888Input:
1889  s[0]+256*s[1]+...+256^63*s[63] = s
1890
1891Output:
1892  s[0]+256*s[1]+...+256^31*s[31] = s mod l
1893  where l = 2^252 + 27742317777372353535851937790883648493.
1894  Overwrites s in place.
1895*/
1896status_t LTC_PKHA_sc_reduce(uint8_t *a)
1897{
1898    uint16_t szA = 0;
1899    return LTC_PKHA_ModRed(LTC_BASE, a, 64, l_coefEdDSA, sizeof(l_coefEdDSA),
1900        a, &szA, kLTC_PKHA_IntegerArith);
1901}
1902
1903/*
1904Input:
1905  a[0]+256*a[1]+...+256^31*a[31] = a
1906  b[0]+256*b[1]+...+256^31*b[31] = b
1907  c[0]+256*c[1]+...+256^31*c[31] = c
1908
1909Output:
1910  s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
1911  where l = 2^252 + 27742317777372353535851937790883648493.
1912*/
1913status_t LTC_PKHA_sc_muladd(uint8_t *s, const uint8_t *a,
1914    const uint8_t *b, const uint8_t *c)
1915{
1916    uint16_t szS = 0;
1917    uint16_t szB = 0;
1918    uint8_t tempB[32] = {0};
1919    status_t status;
1920
1921    /* Assume only b can be larger than modulus. It is called durind
1922     * wc_ed25519_sign_msg() where hram (=a) and nonce(=c)
1923     * have been reduced by LTC_PKHA_sc_reduce()
1924     * Thus reducing b only.
1925     */
1926    status = LTC_PKHA_ModRed(LTC_BASE, b, 32, l_coefEdDSA, sizeof(l_coefEdDSA),
1927        tempB, &szB, kLTC_PKHA_IntegerArith);
1928
1929    if (status == kStatus_Success) {
1930        status = LTC_PKHA_ModMul(LTC_BASE, a, 32, tempB, szB, l_coefEdDSA,
1931            sizeof(l_coefEdDSA), s, &szS, kLTC_PKHA_IntegerArith,
1932            kLTC_PKHA_NormalValue, kLTC_PKHA_NormalValue,
1933            kLTC_PKHA_TimingEqualized);
1934    }
1935
1936    if (status == kStatus_Success) {
1937        status = LTC_PKHA_ModAdd(LTC_BASE, s, szS, c, 32, l_coefEdDSA, 32, s,
1938            &szS, kLTC_PKHA_IntegerArith);
1939    }
1940
1941    return status;
1942}
1943
1944/*
1945r = a * A + b * B
1946where A is public key point, B is basepoint
1947where a = a[0]+256*a[1]+...+256^31 a[31].
1948and b = b[0]+256*b[1]+...+256^31 b[31].
1949B is the Ed25519 base point (x,4/5) with x positive.
1950*/
1951status_t LTC_PKHA_SignatureForVerify(uint8_t *rcheck, const unsigned char *a,
1952    const unsigned char *b, ed25519_key *key)
1953{
1954    /* To verify a signature on a message M, first split the signature
1955       into two 32-octet halves.  Decode the first half as a point R,
1956       and the second half as an integer s, in the range 0 <= s < q.  If
1957       the decoding fails, the signature is invalid. */
1958
1959    /* Check the group equation 8s B = 8 R + 8k A. */
1960
1961    /*
1962       Uses a fast single-signature verification SB = R + H(R,A,M)A becomes
1963       SB - H(R,A,M)A saving decompression of R
1964    */
1965    uint8_t X0[ED25519_PUB_KEY_SIZE] = {0};
1966    uint8_t X1[ED25519_PUB_KEY_SIZE] = {0};
1967    uint8_t Y0[ED25519_PUB_KEY_SIZE] = {0};
1968    uint8_t Y1[ED25519_PUB_KEY_SIZE] = {0};
1969    const uint8_t max[32] = {
1970        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1971        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1972        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
1973    ltc_pkha_ecc_point_t ltc0;
1974    ltc_pkha_ecc_point_t ltc1;
1975    ltc_pkha_ecc_point_t pubKey;
1976    status_t status;
1977
1978    /* The equality for the negative of a point P, in affine coordinates,
1979        is -P = -(x,y) = (x, -y) */
1980    uint16_t szY = 32;
1981
1982    ltc0.X = X0;
1983    ltc1.X = X1;
1984    ltc0.Y = Y0;
1985    ltc1.Y = Y1;
1986    pubKey.X = key->pointX;
1987    pubKey.Y = key->pointY;
1988
1989    /* ltc0 = b*B */
1990    status = LTC_PKHA_Ed25519_PointMul(LTC_PKHA_Ed25519_BasePoint(), b,
1991        ED25519_KEY_SIZE, &ltc0, kLTC_Weierstrass /* result in W */);
1992
1993    /* ltc1 = a*A */
1994    if (status == kStatus_Success) {
1995        status = LTC_PKHA_Ed25519ToWeierstrass(&pubKey, &ltc1);
1996    }
1997    if (status == kStatus_Success) {
1998        status = LTC_PKHA_Ed25519_PointMul(&ltc1, a, ED25519_KEY_SIZE, &ltc1,
1999            kLTC_Weierstrass /* result in W */);
2000    }
2001
2002    /* R = b*B - a*A */
2003    if (status == kStatus_Success) {
2004        status = LTC_PKHA_ModSub1(LTC_BASE, curve25519_modbin,
2005            sizeof(curve25519_modbin), ltc1.Y, szY, max, sizeof(max), ltc1.Y,
2006            &szY);
2007    }
2008    if (status == kStatus_Success) {
2009        status = LTC_PKHA_ECC_PointAdd(LTC_BASE, &ltc0, &ltc1,
2010            curve25519_modbin, r2mod, a_coefEd25519, b_coefEd25519,
2011            ED25519_KEY_SIZE, kLTC_PKHA_IntegerArith, &ltc0);
2012    }
2013    /* map to Ed25519 */
2014    if (status == kStatus_Success) {
2015        status = LTC_PKHA_WeierstrassToEd25519(&ltc0, &ltc0);
2016    }
2017
2018    if (status == kStatus_Success) {
2019        if (((uint32_t)ltc0.X[0]) & 0x01u) {
2020            ltc0.Y[ED25519_KEY_SIZE - 1] |= 0x80u;
2021        }
2022
2023        XMEMCPY(rcheck, ltc0.Y, ED25519_KEY_SIZE);
2024    }
2025
2026    return status;
2027}
2028
2029status_t LTC_PKHA_Ed25519_Compress(const ltc_pkha_ecc_point_t *ltcPointIn,
2030    uint8_t *p)
2031{
2032    /* compress */
2033    /* get sign of X per https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-02
2034     * To form the encoding of the point, copy the least
2035       significant bit of the x-coordinate to the most significant bit of
2036       the final octet
2037     */
2038    XMEMCPY(p, ltcPointIn->Y, ED25519_KEY_SIZE);
2039    if (((uint32_t)ltcPointIn->X[0]) & 0x01u) {
2040        p[ED25519_KEY_SIZE - 1] |= 0x80u;
2041    }
2042    return kStatus_Success;
2043}
2044
2045#endif /* HAVE_ED25519 */
2046#endif /* FREESCALE_LTC_ECC */
2047
2048
2049#undef ERROR_OUT
2050
2051#endif /* FREESCALE_LTC_TFM || FREESCALE_LTC_ECC */