Struct mbedtls_ecp_group

Source

#[repr(C)]
pub struct mbedtls_ecp_group {Show 15 fields
    pub id: mbedtls_ecp_group_id,
    pub P: mbedtls_mpi,
    pub A: mbedtls_mpi,
    pub B: mbedtls_mpi,
    pub G: mbedtls_ecp_point,
    pub N: mbedtls_mpi,
    pub pbits: usize,
    pub nbits: usize,
    pub private_h: c_uint,
    pub private_modp: Option<unsafe extern "C" fn(arg1: *mut mbedtls_mpi) -> c_int>,
    pub private_t_pre: Option<unsafe extern "C" fn(arg1: *mut mbedtls_ecp_point, arg2: *mut c_void) -> c_int>,
    pub private_t_post: Option<unsafe extern "C" fn(arg1: *mut mbedtls_ecp_point, arg2: *mut c_void) -> c_int>,
    pub private_t_data: *mut c_void,
    pub private_T: *mut mbedtls_ecp_point,
    pub private_T_size: usize,
}

Expand description

\brief The ECP group structure.

We consider two types of curve equations:

Short Weierstrass: y^2 = x^3 + A x + B mod P (SEC1 + RFC-4492)
Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, Curve448)

In both cases, the generator (\p G) for a prime-order subgroup is fixed.

For Short Weierstrass, this subgroup is the whole curve, and its cardinality is denoted by \p N. Our code requires that \p N is an odd prime as mbedtls_ecp_mul() requires an odd number, and mbedtls_ecdsa_sign() requires that it is prime for blinding purposes.

The default implementation only initializes \p A without setting it to the authentic value for curves with A = -3(SECP256R1, etc), in which case you need to load \p A by yourself when using domain parameters directly, for example: \code mbedtls_mpi_init(&A); mbedtls_ecp_group_init(&grp); CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); if (mbedtls_ecp_group_a_is_minus_3(&grp)) { CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); } else { CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); }

do_something_with_a(&A);

cleanup: mbedtls_mpi_free(&A); mbedtls_ecp_group_free(&grp); \endcode

For Montgomery curves, we do not store \p A, but (A + 2) / 4, which is the quantity used in the formulas. Additionally, \p nbits is not the size of \p N but the required size for private keys.

If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the range of [0, 2^(2*pbits)), and transforms it in-place to an integer which is congruent mod \p P to the given MPI, is in the range [0, 2P), and has no more non-zero limbs than P, so that it may be efficiently brought into the range [0, P) by a single constant-time conditional subtraction. It must return 0 on success and non-zero on failure.

Fields§

§id: mbedtls_ecp_group_id

< An internal group identifier.

§P: mbedtls_mpi

< The prime modulus of the base field.

§A: mbedtls_mpi

< For Short Weierstrass: \p A in the equation. Note that \p A is not set to the authentic value in some cases. Refer to detailed description of ::mbedtls_ecp_group if using domain parameters in the structure. For Montgomery curves: (A + 2) / 4.

§B: mbedtls_mpi

< For Short Weierstrass: \p B in the equation. For Montgomery curves: unused.

§G: mbedtls_ecp_point

< The generator of the subgroup used.

§N: mbedtls_mpi

< The order of \p G.

§pbits: usize

< The number of bits in \p P.

§nbits: usize

< For Short Weierstrass: The number of bits in \p P. For Montgomery curves: the number of bits in the private keys.

§private_h: c_uint§private_modp: Option<unsafe extern "C" fn(arg1: *mut mbedtls_mpi) -> c_int>§private_t_pre: Option<unsafe extern "C" fn(arg1: *mut mbedtls_ecp_point, arg2: *mut c_void) -> c_int>§private_t_post: Option<unsafe extern "C" fn(arg1: *mut mbedtls_ecp_point, arg2: *mut c_void) -> c_int>§private_t_data: *mut c_void§private_T: *mut mbedtls_ecp_point§private_T_size: usize