#![allow(clippy::op_ref)]
use core::ops::{Mul, Neg};
use elliptic_curve::{
bigint::Encoding,
group::{prime::PrimeCurveAffine, GroupEncoding},
sec1::{self, FromEncodedPoint, ToCompactEncodedPoint, ToEncodedPoint},
subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption},
zeroize::DefaultIsZeroes,
AffineArithmetic, AffineXCoordinate, Curve, DecompactPoint, DecompressPoint, Error, Result,
};
#[cfg(feature = "serde")]
use serdect::serde::{de, ser, Deserialize, Serialize};
use super::{FieldElement, ProjectivePoint, CURVE_EQUATION_A, CURVE_EQUATION_B, MODULUS};
use crate::{CompressedPoint, EncodedPoint, FieldBytes, NistP384, PublicKey, Scalar};
impl AffineArithmetic for NistP384 {
type AffinePoint = AffinePoint;
}
#[derive(Clone, Copy, Debug)]
#[cfg_attr(docsrs, doc(cfg(feature = "arithmetic")))]
pub struct AffinePoint {
pub x: FieldElement,
pub y: FieldElement,
pub infinity: u8,
}
impl AffinePoint {
#[cfg(target_pointer_width = "32")]
pub const GENERATOR: Self = Self {
x: FieldElement([
0x49c0b528, 0x3dd07566, 0xa0d6ce38, 0x20e378e2, 0x541b4d6e, 0x879c3afc, 0x59a30eff,
0x64548684, 0x614ede2b, 0x812ff723, 0x299e1513, 0x4d3aadc2,
]),
y: FieldElement([
0x4b03a4fe, 0x23043dad, 0x7bb4a9ac, 0xa1bfa8bf, 0x2e83b050, 0x8bade756, 0x68f4ffd9,
0xc6c35219, 0x3969a840, 0x3969a840, 0x5a15c5e9, 0x2b78abc2,
]),
infinity: 0,
};
#[cfg(target_pointer_width = "64")]
pub const GENERATOR: Self = Self {
x: FieldElement([
0x3dd07566_49c0b528,
0x20e378e2_a0d6ce38,
0x879c3afc_541b4d6e,
0x64548684_59a30eff,
0x812ff723_614ede2b,
0x4d3aadc2_299e1513,
]),
y: FieldElement([
0x23043dad_4b03a4fe,
0xa1bfa8bf_7bb4a9ac,
0x8bade756_2e83b050,
0xc6c35219_68f4ffd9,
0xdd800226_3969a840,
0x2b78abc2_5a15c5e9,
]),
infinity: 0,
};
pub const IDENTITY: Self = Self {
x: FieldElement::ZERO,
y: FieldElement::ZERO,
infinity: 1,
};
}
impl PrimeCurveAffine for AffinePoint {
type Curve = ProjectivePoint;
type Scalar = Scalar;
fn identity() -> AffinePoint {
Self::IDENTITY
}
fn generator() -> AffinePoint {
Self::GENERATOR
}
fn is_identity(&self) -> Choice {
Choice::from(self.infinity)
}
fn to_curve(&self) -> ProjectivePoint {
ProjectivePoint::from(*self)
}
}
impl AffineXCoordinate<NistP384> for AffinePoint {
fn x(&self) -> FieldBytes {
self.x.to_sec1()
}
}
impl ConditionallySelectable for AffinePoint {
fn conditional_select(a: &AffinePoint, b: &AffinePoint, choice: Choice) -> AffinePoint {
AffinePoint {
x: FieldElement::conditional_select(&a.x, &b.x, choice),
y: FieldElement::conditional_select(&a.y, &b.y, choice),
infinity: u8::conditional_select(&a.infinity, &b.infinity, choice),
}
}
}
impl ConstantTimeEq for AffinePoint {
fn ct_eq(&self, other: &AffinePoint) -> Choice {
self.x.ct_eq(&other.x) & self.y.ct_eq(&other.y) & self.infinity.ct_eq(&other.infinity)
}
}
impl Default for AffinePoint {
fn default() -> Self {
Self::IDENTITY
}
}
impl DefaultIsZeroes for AffinePoint {}
impl Eq for AffinePoint {}
impl PartialEq for AffinePoint {
fn eq(&self, other: &AffinePoint) -> bool {
self.ct_eq(other).into()
}
}
impl Mul<Scalar> for AffinePoint {
type Output = ProjectivePoint;
fn mul(self, scalar: Scalar) -> ProjectivePoint {
ProjectivePoint::from(self) * scalar
}
}
impl Mul<&Scalar> for AffinePoint {
type Output = ProjectivePoint;
fn mul(self, scalar: &Scalar) -> ProjectivePoint {
ProjectivePoint::from(self) * scalar
}
}
impl Neg for AffinePoint {
type Output = AffinePoint;
fn neg(self) -> Self::Output {
AffinePoint {
x: self.x,
y: -self.y,
infinity: self.infinity,
}
}
}
impl DecompressPoint<NistP384> for AffinePoint {
fn decompress(x_bytes: &FieldBytes, y_is_odd: Choice) -> CtOption<Self> {
FieldElement::from_sec1(x_bytes).and_then(|x| {
let alpha = x * &x * &x + &(CURVE_EQUATION_A * &x) + &CURVE_EQUATION_B;
let beta = alpha.sqrt();
beta.map(|beta| {
let y = FieldElement::conditional_select(
&(MODULUS - &beta),
&beta,
beta.is_odd().ct_eq(&y_is_odd),
);
Self { x, y, infinity: 0 }
})
})
}
}
impl GroupEncoding for AffinePoint {
type Repr = CompressedPoint;
fn from_bytes(bytes: &Self::Repr) -> CtOption<Self> {
EncodedPoint::from_bytes(bytes)
.map(|point| CtOption::new(point, Choice::from(1)))
.unwrap_or_else(|_| {
let is_identity = bytes.ct_eq(&Self::Repr::default());
CtOption::new(EncodedPoint::identity(), is_identity)
})
.and_then(|point| Self::from_encoded_point(&point))
}
fn from_bytes_unchecked(bytes: &Self::Repr) -> CtOption<Self> {
Self::from_bytes(bytes)
}
fn to_bytes(&self) -> Self::Repr {
let encoded = self.to_encoded_point(true);
let mut result = CompressedPoint::default();
result[..encoded.len()].copy_from_slice(encoded.as_bytes());
result
}
}
impl DecompactPoint<NistP384> for AffinePoint {
fn decompact(x_bytes: &FieldBytes) -> CtOption<Self> {
FieldElement::from_sec1(x_bytes).and_then(|x| {
let montgomery_y = (x * &x * &x + &(CURVE_EQUATION_A * &x) + &CURVE_EQUATION_B).sqrt();
montgomery_y.map(|montgomery_y| {
let y = montgomery_y.to_canonical();
let p_y = MODULUS - &y;
let borrow = 0;
let recovered_y = if borrow == 0 { y } else { p_y };
AffinePoint {
x,
y: recovered_y.to_montgomery(),
infinity: 0,
}
})
})
}
}
impl FromEncodedPoint<NistP384> for AffinePoint {
fn from_encoded_point(encoded_point: &EncodedPoint) -> CtOption<Self> {
match encoded_point.coordinates() {
sec1::Coordinates::Identity => CtOption::new(Self::identity(), 1.into()),
sec1::Coordinates::Compact { x } => AffinePoint::decompact(x),
sec1::Coordinates::Compressed { x, y_is_odd } => {
AffinePoint::decompress(x, Choice::from(y_is_odd as u8))
}
sec1::Coordinates::Uncompressed { x, y } => {
let x = FieldElement::from_sec1(x);
let y = FieldElement::from_sec1(y);
x.and_then(|x| {
y.and_then(|y| {
let lhs = y * &y;
let rhs = x * &x * &x + &(CURVE_EQUATION_A * &x) + &CURVE_EQUATION_B;
let point = AffinePoint { x, y, infinity: 0 };
CtOption::new(point, lhs.ct_eq(&rhs))
})
})
}
}
}
}
impl ToEncodedPoint<NistP384> for AffinePoint {
fn to_encoded_point(&self, compress: bool) -> EncodedPoint {
EncodedPoint::conditional_select(
&EncodedPoint::from_affine_coordinates(&self.x.to_sec1(), &self.y.to_sec1(), compress),
&EncodedPoint::identity(),
self.is_identity(),
)
}
}
impl ToCompactEncodedPoint<NistP384> for AffinePoint {
fn to_compact_encoded_point(&self) -> CtOption<EncodedPoint> {
let y = self.y.to_canonical();
let (p_y, borrow) = MODULUS.informed_subtract(&y);
assert_eq!(borrow, 0);
let (_, borrow) = p_y.informed_subtract(&y);
let mut bytes = CompressedPoint::default();
bytes[0] = sec1::Tag::Compact.into();
let x = self.x.to_sec1();
bytes[1..(<NistP384 as Curve>::UInt::BYTE_SIZE + 1)].copy_from_slice(x.as_slice());
CtOption::new(
EncodedPoint::from_bytes(bytes).expect("compact key"),
borrow.ct_eq(&0),
)
}
}
impl TryFrom<EncodedPoint> for AffinePoint {
type Error = Error;
fn try_from(point: EncodedPoint) -> Result<AffinePoint> {
AffinePoint::try_from(&point)
}
}
impl TryFrom<&EncodedPoint> for AffinePoint {
type Error = Error;
fn try_from(point: &EncodedPoint) -> Result<AffinePoint> {
Option::from(AffinePoint::from_encoded_point(point)).ok_or(Error)
}
}
impl From<AffinePoint> for EncodedPoint {
fn from(affine_point: AffinePoint) -> EncodedPoint {
affine_point.to_encoded_point(false)
}
}
impl From<PublicKey> for AffinePoint {
fn from(public_key: PublicKey) -> AffinePoint {
*public_key.as_affine()
}
}
impl From<&PublicKey> for AffinePoint {
fn from(public_key: &PublicKey) -> AffinePoint {
AffinePoint::from(*public_key)
}
}
impl TryFrom<AffinePoint> for PublicKey {
type Error = Error;
fn try_from(affine_point: AffinePoint) -> Result<PublicKey> {
PublicKey::from_affine(affine_point)
}
}
impl TryFrom<&AffinePoint> for PublicKey {
type Error = Error;
fn try_from(affine_point: &AffinePoint) -> Result<PublicKey> {
PublicKey::try_from(*affine_point)
}
}
#[cfg(feature = "serde")]
#[cfg_attr(docsrs, doc(cfg(feature = "serde")))]
impl Serialize for AffinePoint {
fn serialize<S>(&self, serializer: S) -> core::result::Result<S::Ok, S::Error>
where
S: ser::Serializer,
{
self.to_encoded_point(true).serialize(serializer)
}
}
#[cfg(feature = "serde")]
#[cfg_attr(docsrs, doc(cfg(feature = "serde")))]
impl<'de> Deserialize<'de> for AffinePoint {
fn deserialize<D>(deserializer: D) -> core::result::Result<Self, D::Error>
where
D: de::Deserializer<'de>,
{
EncodedPoint::deserialize(deserializer)?
.try_into()
.map_err(de::Error::custom)
}
}
#[cfg(test)]
mod tests {
use elliptic_curve::{
group::{prime::PrimeCurveAffine, GroupEncoding},
sec1::{FromEncodedPoint, ToEncodedPoint},
};
use hex_literal::hex;
use super::AffinePoint;
use crate::EncodedPoint;
const UNCOMPRESSED_BASEPOINT: &[u8] = &hex!(
"04 aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98
59f741e0 82542a38 5502f25d bf55296c 3a545e38 72760ab7
3617de4a 96262c6f 5d9e98bf 9292dc29 f8f41dbd 289a147c
e9da3113 b5f0b8c0 0a60b1ce 1d7e819d 7a431d7c 90ea0e5f"
);
const COMPRESSED_BASEPOINT: &[u8] = &hex!(
"03 aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98
59f741e0 82542a38 5502f25d bf55296c 3a545e38 72760ab7"
);
#[test]
fn uncompressed_round_trip() {
let pubkey = EncodedPoint::from_bytes(UNCOMPRESSED_BASEPOINT).unwrap();
let point = AffinePoint::from_encoded_point(&pubkey).unwrap();
assert_eq!(point, AffinePoint::generator());
let res: EncodedPoint = point.into();
assert_eq!(res, pubkey);
}
#[test]
fn compressed_round_trip() {
let pubkey = EncodedPoint::from_bytes(COMPRESSED_BASEPOINT).unwrap();
let point = AffinePoint::from_encoded_point(&pubkey).unwrap();
assert_eq!(point, AffinePoint::generator());
let res: EncodedPoint = point.to_encoded_point(true);
assert_eq!(res, pubkey);
}
#[test]
fn uncompressed_to_compressed() {
let encoded = EncodedPoint::from_bytes(UNCOMPRESSED_BASEPOINT).unwrap();
let res = AffinePoint::from_encoded_point(&encoded)
.unwrap()
.to_encoded_point(true);
assert_eq!(res.as_bytes(), COMPRESSED_BASEPOINT);
}
#[test]
fn compressed_to_uncompressed() {
let encoded = EncodedPoint::from_bytes(COMPRESSED_BASEPOINT).unwrap();
let res = AffinePoint::from_encoded_point(&encoded).unwrap();
let res = res.to_encoded_point(false);
assert_eq!(res.as_bytes(), UNCOMPRESSED_BASEPOINT);
}
#[test]
fn affine_negation() {
let basepoint = AffinePoint::generator();
assert_eq!(-(-basepoint), basepoint);
}
#[test]
fn identity_encoding() {
assert_eq!([0; 49], AffinePoint::IDENTITY.to_bytes().as_slice());
assert!(bool::from(
AffinePoint::from_bytes(&AffinePoint::IDENTITY.to_bytes())
.unwrap()
.is_identity()
))
}
}