org.bouncycastle.math.ec.ECPoint Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of bcprov-ext-debug-jdk18on Show documentation
Show all versions of bcprov-ext-debug-jdk18on Show documentation
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for Java 1.8 and later with debug enabled.
The newest version!
package org.bouncycastle.math.ec;
import java.math.BigInteger;
import java.security.SecureRandom;
import java.util.Hashtable;
import org.bouncycastle.crypto.CryptoServicesRegistrar;
/**
* base class for points on elliptic curves.
*/
public abstract class ECPoint
{
protected final static ECFieldElement[] EMPTY_ZS = new ECFieldElement[0];
protected static ECFieldElement[] getInitialZCoords(ECCurve curve)
{
// Cope with null curve, most commonly used by implicitlyCa
int coord = null == curve ? ECCurve.COORD_AFFINE : curve.getCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_AFFINE:
case ECCurve.COORD_LAMBDA_AFFINE:
return EMPTY_ZS;
default:
break;
}
ECFieldElement one = curve.fromBigInteger(ECConstants.ONE);
switch (coord)
{
case ECCurve.COORD_HOMOGENEOUS:
case ECCurve.COORD_JACOBIAN:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
return new ECFieldElement[]{ one };
case ECCurve.COORD_JACOBIAN_CHUDNOVSKY:
return new ECFieldElement[]{ one, one, one };
case ECCurve.COORD_JACOBIAN_MODIFIED:
return new ECFieldElement[]{ one, curve.getA() };
default:
throw new IllegalArgumentException("unknown coordinate system");
}
}
protected ECCurve curve;
protected ECFieldElement x;
protected ECFieldElement y;
protected ECFieldElement[] zs;
// Hashtable is (String -> PreCompInfo)
protected Hashtable preCompTable = null;
protected ECPoint(ECCurve curve, ECFieldElement x, ECFieldElement y)
{
this(curve, x, y, getInitialZCoords(curve));
}
protected ECPoint(ECCurve curve, ECFieldElement x, ECFieldElement y, ECFieldElement[] zs)
{
this.curve = curve;
this.x = x;
this.y = y;
this.zs = zs;
}
protected abstract boolean satisfiesCurveEquation();
protected boolean satisfiesOrder()
{
if (ECConstants.ONE.equals(curve.getCofactor()))
{
return true;
}
BigInteger n = curve.getOrder();
// TODO Require order to be available for all curves
return n == null || ECAlgorithms.referenceMultiply(this, n).isInfinity();
}
public final ECPoint getDetachedPoint()
{
return normalize().detach();
}
public ECCurve getCurve()
{
return curve;
}
protected abstract ECPoint detach();
protected int getCurveCoordinateSystem()
{
// Cope with null curve, most commonly used by implicitlyCa
return null == curve ? ECCurve.COORD_AFFINE : curve.getCoordinateSystem();
}
/**
* Returns the affine x-coordinate after checking that this point is normalized.
*
* @return The affine x-coordinate of this point
* @throws IllegalStateException if the point is not normalized
*/
public ECFieldElement getAffineXCoord()
{
checkNormalized();
return getXCoord();
}
/**
* Returns the affine y-coordinate after checking that this point is normalized
*
* @return The affine y-coordinate of this point
* @throws IllegalStateException if the point is not normalized
*/
public ECFieldElement getAffineYCoord()
{
checkNormalized();
return getYCoord();
}
/**
* Returns the x-coordinate.
*
* Caution: depending on the curve's coordinate system, this may not be the same value as in an
* affine coordinate system; use normalize() to get a point where the coordinates have their
* affine values, or use getAffineXCoord() if you expect the point to already have been
* normalized.
*
* @return the x-coordinate of this point
*/
public ECFieldElement getXCoord()
{
return x;
}
/**
* Returns the y-coordinate.
*
* Caution: depending on the curve's coordinate system, this may not be the same value as in an
* affine coordinate system; use normalize() to get a point where the coordinates have their
* affine values, or use getAffineYCoord() if you expect the point to already have been
* normalized.
*
* @return the y-coordinate of this point
*/
public ECFieldElement getYCoord()
{
return y;
}
public ECFieldElement getZCoord(int index)
{
return (index < 0 || index >= zs.length) ? null : zs[index];
}
public ECFieldElement[] getZCoords()
{
int zsLen = zs.length;
if (zsLen == 0)
{
return EMPTY_ZS;
}
ECFieldElement[] copy = new ECFieldElement[zsLen];
System.arraycopy(zs, 0, copy, 0, zsLen);
return copy;
}
public final ECFieldElement getRawXCoord()
{
return x;
}
public final ECFieldElement getRawYCoord()
{
return y;
}
protected final ECFieldElement[] getRawZCoords()
{
return zs;
}
protected void checkNormalized()
{
if (!isNormalized())
{
throw new IllegalStateException("point not in normal form");
}
}
public boolean isNormalized()
{
int coord = this.getCurveCoordinateSystem();
return coord == ECCurve.COORD_AFFINE
|| coord == ECCurve.COORD_LAMBDA_AFFINE
|| isInfinity()
|| zs[0].isOne();
}
/**
* Normalization ensures that any projective coordinate is 1, and therefore that the x, y
* coordinates reflect those of the equivalent point in an affine coordinate system.
*
* @return a new ECPoint instance representing the same point, but with normalized coordinates
*/
public ECPoint normalize()
{
if (this.isInfinity())
{
return this;
}
switch (this.getCurveCoordinateSystem())
{
case ECCurve.COORD_AFFINE:
case ECCurve.COORD_LAMBDA_AFFINE:
{
return this;
}
default:
{
ECFieldElement z = getZCoord(0);
if (z.isOne())
{
return this;
}
if (null == curve)
{
throw new IllegalStateException("Detached points must be in affine coordinates");
}
/*
* Use blinding to avoid the side-channel leak identified and analyzed in the paper
* "Yet another GCD based inversion side-channel affecting ECC implementations" by Nir
* Drucker and Shay Gueron.
*
* To blind the calculation of z^-1, choose a multiplicative (i.e. non-zero) field
* element 'b' uniformly at random, then calculate the result instead as (z * b)^-1 * b.
* Any side-channel in the implementation of 'inverse' now only leaks information about
* the value (z * b), and no longer reveals information about 'z' itself.
*/
SecureRandom r = CryptoServicesRegistrar.getSecureRandom();
ECFieldElement b = curve.randomFieldElementMult(r);
ECFieldElement zInv = z.multiply(b).invert().multiply(b);
return normalize(zInv);
}
}
}
ECPoint normalize(ECFieldElement zInv)
{
switch (this.getCurveCoordinateSystem())
{
case ECCurve.COORD_HOMOGENEOUS:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
return createScaledPoint(zInv, zInv);
}
case ECCurve.COORD_JACOBIAN:
case ECCurve.COORD_JACOBIAN_CHUDNOVSKY:
case ECCurve.COORD_JACOBIAN_MODIFIED:
{
ECFieldElement zInv2 = zInv.square(), zInv3 = zInv2.multiply(zInv);
return createScaledPoint(zInv2, zInv3);
}
default:
{
throw new IllegalStateException("not a projective coordinate system");
}
}
}
protected ECPoint createScaledPoint(ECFieldElement sx, ECFieldElement sy)
{
return this.getCurve().createRawPoint(getRawXCoord().multiply(sx), getRawYCoord().multiply(sy));
}
public boolean isInfinity()
{
return x == null || y == null || (zs.length > 0 && zs[0].isZero());
}
public boolean isValid()
{
return implIsValid(false, true);
}
boolean isValidPartial()
{
return implIsValid(false, false);
}
boolean implIsValid(final boolean decompressed, final boolean checkOrder)
{
if (isInfinity())
{
return true;
}
ValidityPrecompInfo validity = (ValidityPrecompInfo)getCurve().precompute(this, ValidityPrecompInfo.PRECOMP_NAME, new PreCompCallback()
{
public PreCompInfo precompute(PreCompInfo existing)
{
ValidityPrecompInfo info = (existing instanceof ValidityPrecompInfo) ? (ValidityPrecompInfo)existing : null;
if (info == null)
{
info = new ValidityPrecompInfo();
}
if (info.hasFailed())
{
return info;
}
if (!info.hasCurveEquationPassed())
{
if (!decompressed && !satisfiesCurveEquation())
{
info.reportFailed();
return info;
}
info.reportCurveEquationPassed();
}
if (checkOrder && !info.hasOrderPassed())
{
if (!satisfiesOrder())
{
info.reportFailed();
return info;
}
info.reportOrderPassed();
}
return info;
}
});
return !validity.hasFailed();
}
public ECPoint scaleX(ECFieldElement scale)
{
return isInfinity()
? this
: getCurve().createRawPoint(getRawXCoord().multiply(scale), getRawYCoord(), getRawZCoords());
}
public ECPoint scaleXNegateY(ECFieldElement scale)
{
return isInfinity()
? this
: getCurve().createRawPoint(getRawXCoord().multiply(scale), getRawYCoord().negate(), getRawZCoords());
}
public ECPoint scaleY(ECFieldElement scale)
{
return isInfinity()
? this
: getCurve().createRawPoint(getRawXCoord(), getRawYCoord().multiply(scale), getRawZCoords());
}
public ECPoint scaleYNegateX(ECFieldElement scale)
{
return isInfinity()
? this
: getCurve().createRawPoint(getRawXCoord().negate(), getRawYCoord().multiply(scale), getRawZCoords());
}
public boolean equals(ECPoint other)
{
if (null == other)
{
return false;
}
ECCurve c1 = this.getCurve(), c2 = other.getCurve();
boolean n1 = (null == c1), n2 = (null == c2);
boolean i1 = isInfinity(), i2 = other.isInfinity();
if (i1 || i2)
{
return (i1 && i2) && (n1 || n2 || c1.equals(c2));
}
ECPoint p1 = this, p2 = other;
if (n1 && n2)
{
// Points with null curve are in affine form, so already normalized
}
else if (n1)
{
p2 = p2.normalize();
}
else if (n2)
{
p1 = p1.normalize();
}
else if (!c1.equals(c2))
{
return false;
}
else
{
// TODO Consider just requiring already normalized, to avoid silent performance degradation
ECPoint[] points = new ECPoint[]{ this, c1.importPoint(p2) };
// TODO This is a little strong, really only requires coZNormalizeAll to get Zs equal
c1.normalizeAll(points);
p1 = points[0];
p2 = points[1];
}
return p1.getXCoord().equals(p2.getXCoord()) && p1.getYCoord().equals(p2.getYCoord());
}
public boolean equals(Object other)
{
if (other == this)
{
return true;
}
if (!(other instanceof ECPoint))
{
return false;
}
return equals((ECPoint)other);
}
public int hashCode()
{
ECCurve c = this.getCurve();
int hc = (null == c) ? 0 : ~c.hashCode();
if (!this.isInfinity())
{
// TODO Consider just requiring already normalized, to avoid silent performance degradation
ECPoint p = normalize();
hc ^= p.getXCoord().hashCode() * 17;
hc ^= p.getYCoord().hashCode() * 257;
}
return hc;
}
public String toString()
{
if (this.isInfinity())
{
return "INF";
}
StringBuffer sb = new StringBuffer();
sb.append('(');
sb.append(getRawXCoord());
sb.append(',');
sb.append(getRawYCoord());
for (int i = 0; i < zs.length; ++i)
{
sb.append(',');
sb.append(zs[i]);
}
sb.append(')');
return sb.toString();
}
/**
* Get an encoding of the point value, optionally in compressed format.
*
* @param compressed whether to generate a compressed point encoding.
* @return the point encoding
*/
public byte[] getEncoded(boolean compressed)
{
if (this.isInfinity())
{
return new byte[1];
}
ECPoint normed = normalize();
byte[] X = normed.getXCoord().getEncoded();
if (compressed)
{
byte[] PO = new byte[X.length + 1];
PO[0] = (byte)(normed.getCompressionYTilde() ? 0x03 : 0x02);
System.arraycopy(X, 0, PO, 1, X.length);
return PO;
}
byte[] Y = normed.getYCoord().getEncoded();
byte[] PO = new byte[X.length + Y.length + 1];
PO[0] = 0x04;
System.arraycopy(X, 0, PO, 1, X.length);
System.arraycopy(Y, 0, PO, X.length + 1, Y.length);
return PO;
}
protected abstract boolean getCompressionYTilde();
public abstract ECPoint add(ECPoint b);
public abstract ECPoint negate();
public abstract ECPoint subtract(ECPoint b);
public ECPoint timesPow2(int e)
{
if (e < 0)
{
throw new IllegalArgumentException("'e' cannot be negative");
}
ECPoint p = this;
while (--e >= 0)
{
p = p.twice();
}
return p;
}
public abstract ECPoint twice();
public ECPoint twicePlus(ECPoint b)
{
return twice().add(b);
}
public ECPoint threeTimes()
{
return twicePlus(this);
}
/**
* Multiplies this ECPoint by the given number.
* @param k The multiplicator.
* @return k * this.
*/
public ECPoint multiply(BigInteger k)
{
return this.getCurve().getMultiplier().multiply(this, k);
}
public static abstract class AbstractFp extends ECPoint
{
protected AbstractFp(ECCurve curve, ECFieldElement x, ECFieldElement y)
{
super(curve, x, y);
}
protected AbstractFp(ECCurve curve, ECFieldElement x, ECFieldElement y, ECFieldElement[] zs)
{
super(curve, x, y, zs);
}
protected boolean getCompressionYTilde()
{
return this.getAffineYCoord().testBitZero();
}
protected boolean satisfiesCurveEquation()
{
ECFieldElement X = this.x, Y = this.y, A = curve.getA(), B = curve.getB();
ECFieldElement lhs = Y.square();
switch (this.getCurveCoordinateSystem())
{
case ECCurve.COORD_AFFINE:
break;
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Z = this.zs[0];
if (!Z.isOne())
{
ECFieldElement Z2 = Z.square(), Z3 = Z.multiply(Z2);
lhs = lhs.multiply(Z);
A = A.multiply(Z2);
B = B.multiply(Z3);
}
break;
}
case ECCurve.COORD_JACOBIAN:
case ECCurve.COORD_JACOBIAN_CHUDNOVSKY:
case ECCurve.COORD_JACOBIAN_MODIFIED:
{
ECFieldElement Z = this.zs[0];
if (!Z.isOne())
{
ECFieldElement Z2 = Z.square(), Z4 = Z2.square(), Z6 = Z2.multiply(Z4);
A = A.multiply(Z4);
B = B.multiply(Z6);
}
break;
}
default:
throw new IllegalStateException("unsupported coordinate system");
}
ECFieldElement rhs = X.square().add(A).multiply(X).add(B);
return lhs.equals(rhs);
}
public ECPoint subtract(ECPoint b)
{
if (b.isInfinity())
{
return this;
}
// Add -b
return this.add(b.negate());
}
}
/**
* Elliptic curve points over Fp
*/
public static class Fp extends AbstractFp
{
Fp(ECCurve curve, ECFieldElement x, ECFieldElement y)
{
super(curve, x, y);
}
Fp(ECCurve curve, ECFieldElement x, ECFieldElement y, ECFieldElement[] zs)
{
super(curve, x, y, zs);
}
protected ECPoint detach()
{
return new ECPoint.Fp(null, this.getAffineXCoord(), this.getAffineYCoord());
}
public ECFieldElement getZCoord(int index)
{
if (index == 1 && ECCurve.COORD_JACOBIAN_MODIFIED == this.getCurveCoordinateSystem())
{
return getJacobianModifiedW();
}
return super.getZCoord(index);
}
// B.3 pg 62
public ECPoint add(ECPoint b)
{
if (this.isInfinity())
{
return b;
}
if (b.isInfinity())
{
return this;
}
if (this == b)
{
return twice();
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
ECFieldElement X1 = this.x, Y1 = this.y;
ECFieldElement X2 = b.x, Y2 = b.y;
switch (coord)
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement dx = X2.subtract(X1), dy = Y2.subtract(Y1);
if (dx.isZero())
{
if (dy.isZero())
{
// this == b, i.e. this must be doubled
return twice();
}
// this == -b, i.e. the result is the point at infinity
return curve.getInfinity();
}
ECFieldElement gamma = dy.divide(dx);
ECFieldElement X3 = gamma.square().subtract(X1).subtract(X2);
ECFieldElement Y3 = gamma.multiply(X1.subtract(X3)).subtract(Y1);
return new ECPoint.Fp(curve, X3, Y3);
}
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Z1 = this.zs[0];
ECFieldElement Z2 = b.zs[0];
boolean Z1IsOne = Z1.isOne();
boolean Z2IsOne = Z2.isOne();
ECFieldElement u1 = Z1IsOne ? Y2 : Y2.multiply(Z1);
ECFieldElement u2 = Z2IsOne ? Y1 : Y1.multiply(Z2);
ECFieldElement u = u1.subtract(u2);
ECFieldElement v1 = Z1IsOne ? X2 : X2.multiply(Z1);
ECFieldElement v2 = Z2IsOne ? X1 : X1.multiply(Z2);
ECFieldElement v = v1.subtract(v2);
// Check if b == this or b == -this
if (v.isZero())
{
if (u.isZero())
{
// this == b, i.e. this must be doubled
return this.twice();
}
// this == -b, i.e. the result is the point at infinity
return curve.getInfinity();
}
// TODO Optimize for when w == 1
ECFieldElement w = Z1IsOne ? Z2 : Z2IsOne ? Z1 : Z1.multiply(Z2);
ECFieldElement vSquared = v.square();
ECFieldElement vCubed = vSquared.multiply(v);
ECFieldElement vSquaredV2 = vSquared.multiply(v2);
ECFieldElement A = u.square().multiply(w).subtract(vCubed).subtract(two(vSquaredV2));
ECFieldElement X3 = v.multiply(A);
ECFieldElement Y3 = vSquaredV2.subtract(A).multiplyMinusProduct(u, u2, vCubed);
ECFieldElement Z3 = vCubed.multiply(w);
return new ECPoint.Fp(curve, X3, Y3, new ECFieldElement[]{ Z3 });
}
case ECCurve.COORD_JACOBIAN:
case ECCurve.COORD_JACOBIAN_MODIFIED:
{
ECFieldElement Z1 = this.zs[0];
ECFieldElement Z2 = b.zs[0];
boolean Z1IsOne = Z1.isOne();
ECFieldElement X3, Y3, Z3, Z3Squared = null;
if (!Z1IsOne && Z1.equals(Z2))
{
// TODO Make this available as public method coZAdd?
ECFieldElement dx = X1.subtract(X2), dy = Y1.subtract(Y2);
if (dx.isZero())
{
if (dy.isZero())
{
return twice();
}
return curve.getInfinity();
}
ECFieldElement C = dx.square();
ECFieldElement W1 = X1.multiply(C), W2 = X2.multiply(C);
ECFieldElement A1 = W1.subtract(W2).multiply(Y1);
X3 = dy.square().subtract(W1).subtract(W2);
Y3 = W1.subtract(X3).multiply(dy).subtract(A1);
Z3 = dx;
Z3 = Z3.multiply(Z1);
}
else
{
ECFieldElement Z1Squared, U2, S2;
if (Z1IsOne)
{
Z1Squared = Z1; U2 = X2; S2 = Y2;
}
else
{
Z1Squared = Z1.square();
U2 = Z1Squared.multiply(X2);
ECFieldElement Z1Cubed = Z1Squared.multiply(Z1);
S2 = Z1Cubed.multiply(Y2);
}
boolean Z2IsOne = Z2.isOne();
ECFieldElement Z2Squared, U1, S1;
if (Z2IsOne)
{
Z2Squared = Z2; U1 = X1; S1 = Y1;
}
else
{
Z2Squared = Z2.square();
U1 = Z2Squared.multiply(X1);
ECFieldElement Z2Cubed = Z2Squared.multiply(Z2);
S1 = Z2Cubed.multiply(Y1);
}
ECFieldElement H = U1.subtract(U2);
ECFieldElement R = S1.subtract(S2);
// Check if b == this or b == -this
if (H.isZero())
{
if (R.isZero())
{
// this == b, i.e. this must be doubled
return this.twice();
}
// this == -b, i.e. the result is the point at infinity
return curve.getInfinity();
}
ECFieldElement HSquared = H.square();
ECFieldElement G = HSquared.multiply(H);
ECFieldElement V = HSquared.multiply(U1);
X3 = R.square().add(G).subtract(two(V));
Y3 = V.subtract(X3).multiplyMinusProduct(R, G, S1);
Z3 = H;
if (!Z1IsOne)
{
Z3 = Z3.multiply(Z1);
}
if (!Z2IsOne)
{
Z3 = Z3.multiply(Z2);
}
// Alternative calculation of Z3 using fast square
// X3 = four(X3);
// Y3 = eight(Y3);
// Z3 = doubleProductFromSquares(Z1, Z2, Z1Squared, Z2Squared).multiply(H);
if (Z3 == H)
{
Z3Squared = HSquared;
}
}
ECFieldElement[] zs;
if (coord == ECCurve.COORD_JACOBIAN_MODIFIED)
{
// TODO If the result will only be used in a subsequent addition, we don't need W3
ECFieldElement W3 = calculateJacobianModifiedW(Z3, Z3Squared);
zs = new ECFieldElement[]{ Z3, W3 };
}
else
{
zs = new ECFieldElement[]{ Z3 };
}
return new ECPoint.Fp(curve, X3, Y3, zs);
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
// B.3 pg 62
public ECPoint twice()
{
if (this.isInfinity())
{
return this;
}
ECCurve curve = this.getCurve();
ECFieldElement Y1 = this.y;
if (Y1.isZero())
{
return curve.getInfinity();
}
int coord = curve.getCoordinateSystem();
ECFieldElement X1 = this.x;
switch (coord)
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement X1Squared = X1.square();
ECFieldElement gamma = three(X1Squared).add(this.getCurve().getA()).divide(two(Y1));
ECFieldElement X3 = gamma.square().subtract(two(X1));
ECFieldElement Y3 = gamma.multiply(X1.subtract(X3)).subtract(Y1);
return new ECPoint.Fp(curve, X3, Y3);
}
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Z1 = this.zs[0];
boolean Z1IsOne = Z1.isOne();
// TODO Optimize for small negative a4 and -3
ECFieldElement w = curve.getA();
if (!w.isZero() && !Z1IsOne)
{
w = w.multiply(Z1.square());
}
w = w.add(three(X1.square()));
ECFieldElement s = Z1IsOne ? Y1 : Y1.multiply(Z1);
ECFieldElement t = Z1IsOne ? Y1.square() : s.multiply(Y1);
ECFieldElement B = X1.multiply(t);
ECFieldElement _4B = four(B);
ECFieldElement h = w.square().subtract(two(_4B));
ECFieldElement _2s = two(s);
ECFieldElement X3 = h.multiply(_2s);
ECFieldElement _2t = two(t);
ECFieldElement Y3 = _4B.subtract(h).multiply(w).subtract(two(_2t.square()));
ECFieldElement _4sSquared = Z1IsOne ? two(_2t) : _2s.square();
ECFieldElement Z3 = two(_4sSquared).multiply(s);
return new ECPoint.Fp(curve, X3, Y3, new ECFieldElement[]{ Z3 });
}
case ECCurve.COORD_JACOBIAN:
{
ECFieldElement Z1 = this.zs[0];
boolean Z1IsOne = Z1.isOne();
ECFieldElement Y1Squared = Y1.square();
ECFieldElement T = Y1Squared.square();
ECFieldElement a4 = curve.getA();
ECFieldElement a4Neg = a4.negate();
ECFieldElement M, S;
if (a4Neg.toBigInteger().equals(BigInteger.valueOf(3)))
{
ECFieldElement Z1Squared = Z1IsOne ? Z1 : Z1.square();
M = three(X1.add(Z1Squared).multiply(X1.subtract(Z1Squared)));
S = four(Y1Squared.multiply(X1));
}
else
{
ECFieldElement X1Squared = X1.square();
M = three(X1Squared);
if (Z1IsOne)
{
M = M.add(a4);
}
else if (!a4.isZero())
{
ECFieldElement Z1Squared = Z1.square();
ECFieldElement Z1Pow4 = Z1Squared.square();
if (a4Neg.bitLength() < a4.bitLength())
{
M = M.subtract(Z1Pow4.multiply(a4Neg));
}
else
{
M = M.add(Z1Pow4.multiply(a4));
}
}
// S = two(doubleProductFromSquares(X1, Y1Squared, X1Squared, T));
S = four(X1.multiply(Y1Squared));
}
ECFieldElement X3 = M.square().subtract(two(S));
ECFieldElement Y3 = S.subtract(X3).multiply(M).subtract(eight(T));
ECFieldElement Z3 = two(Y1);
if (!Z1IsOne)
{
Z3 = Z3.multiply(Z1);
}
// Alternative calculation of Z3 using fast square
// ECFieldElement Z3 = doubleProductFromSquares(Y1, Z1, Y1Squared, Z1Squared);
return new ECPoint.Fp(curve, X3, Y3, new ECFieldElement[]{ Z3 });
}
case ECCurve.COORD_JACOBIAN_MODIFIED:
{
return twiceJacobianModified(true);
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
public ECPoint twicePlus(ECPoint b)
{
if (this == b)
{
return threeTimes();
}
if (this.isInfinity())
{
return b;
}
if (b.isInfinity())
{
return twice();
}
ECFieldElement Y1 = this.y;
if (Y1.isZero())
{
return b;
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement X1 = this.x;
ECFieldElement X2 = b.x, Y2 = b.y;
ECFieldElement dx = X2.subtract(X1), dy = Y2.subtract(Y1);
if (dx.isZero())
{
if (dy.isZero())
{
// this == b i.e. the result is 3P
return threeTimes();
}
// this == -b, i.e. the result is P
return this;
}
/*
* Optimized calculation of 2P + Q, as described in "Trading Inversions for
* Multiplications in Elliptic Curve Cryptography", by Ciet, Joye, Lauter, Montgomery.
*/
ECFieldElement X = dx.square(), Y = dy.square();
ECFieldElement d = X.multiply(two(X1).add(X2)).subtract(Y);
if (d.isZero())
{
return curve.getInfinity();
}
ECFieldElement D = d.multiply(dx);
ECFieldElement I = D.invert();
ECFieldElement L1 = d.multiply(I).multiply(dy);
ECFieldElement L2 = two(Y1).multiply(X).multiply(dx).multiply(I).subtract(L1);
ECFieldElement X4 = (L2.subtract(L1)).multiply(L1.add(L2)).add(X2);
ECFieldElement Y4 = (X1.subtract(X4)).multiply(L2).subtract(Y1);
return new ECPoint.Fp(curve, X4, Y4);
}
case ECCurve.COORD_JACOBIAN_MODIFIED:
{
return twiceJacobianModified(false).add(b);
}
default:
{
return twice().add(b);
}
}
}
public ECPoint threeTimes()
{
if (this.isInfinity())
{
return this;
}
ECFieldElement Y1 = this.y;
if (Y1.isZero())
{
return this;
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement X1 = this.x;
ECFieldElement _2Y1 = two(Y1);
ECFieldElement X = _2Y1.square();
ECFieldElement Z = three(X1.square()).add(this.getCurve().getA());
ECFieldElement Y = Z.square();
ECFieldElement d = three(X1).multiply(X).subtract(Y);
if (d.isZero())
{
return this.getCurve().getInfinity();
}
ECFieldElement D = d.multiply(_2Y1);
ECFieldElement I = D.invert();
ECFieldElement L1 = d.multiply(I).multiply(Z);
ECFieldElement L2 = X.square().multiply(I).subtract(L1);
ECFieldElement X4 = (L2.subtract(L1)).multiply(L1.add(L2)).add(X1);
ECFieldElement Y4 = (X1.subtract(X4)).multiply(L2).subtract(Y1);
return new ECPoint.Fp(curve, X4, Y4);
}
case ECCurve.COORD_JACOBIAN_MODIFIED:
{
return twiceJacobianModified(false).add(this);
}
default:
{
// NOTE: Be careful about recursions between twicePlus and threeTimes
return twice().add(this);
}
}
}
public ECPoint timesPow2(int e)
{
if (e < 0)
{
throw new IllegalArgumentException("'e' cannot be negative");
}
if (e == 0 || this.isInfinity())
{
return this;
}
if (e == 1)
{
return twice();
}
ECCurve curve = this.getCurve();
ECFieldElement Y1 = this.y;
if (Y1.isZero())
{
return curve.getInfinity();
}
int coord = curve.getCoordinateSystem();
ECFieldElement W1 = curve.getA();
ECFieldElement X1 = this.x;
ECFieldElement Z1 = this.zs.length < 1 ? curve.fromBigInteger(ECConstants.ONE) : this.zs[0];
if (!Z1.isOne())
{
switch (coord)
{
case ECCurve.COORD_AFFINE:
break;
case ECCurve.COORD_HOMOGENEOUS:
ECFieldElement Z1Sq = Z1.square();
X1 = X1.multiply(Z1);
Y1 = Y1.multiply(Z1Sq);
W1 = calculateJacobianModifiedW(Z1, Z1Sq);
break;
case ECCurve.COORD_JACOBIAN:
W1 = calculateJacobianModifiedW(Z1, null);
break;
case ECCurve.COORD_JACOBIAN_MODIFIED:
W1 = getJacobianModifiedW();
break;
default:
throw new IllegalStateException("unsupported coordinate system");
}
}
for (int i = 0; i < e; ++i)
{
if (Y1.isZero())
{
return curve.getInfinity();
}
ECFieldElement X1Squared = X1.square();
ECFieldElement M = three(X1Squared);
ECFieldElement _2Y1 = two(Y1);
ECFieldElement _2Y1Squared = _2Y1.multiply(Y1);
ECFieldElement S = two(X1.multiply(_2Y1Squared));
ECFieldElement _4T = _2Y1Squared.square();
ECFieldElement _8T = two(_4T);
if (!W1.isZero())
{
M = M.add(W1);
W1 = two(_8T.multiply(W1));
}
X1 = M.square().subtract(two(S));
Y1 = M.multiply(S.subtract(X1)).subtract(_8T);
Z1 = Z1.isOne() ? _2Y1 : _2Y1.multiply(Z1);
}
switch (coord)
{
case ECCurve.COORD_AFFINE:
ECFieldElement zInv = Z1.invert(), zInv2 = zInv.square(), zInv3 = zInv2.multiply(zInv);
return new Fp(curve, X1.multiply(zInv2), Y1.multiply(zInv3));
case ECCurve.COORD_HOMOGENEOUS:
X1 = X1.multiply(Z1);
Z1 = Z1.multiply(Z1.square());
return new Fp(curve, X1, Y1, new ECFieldElement[]{ Z1 });
case ECCurve.COORD_JACOBIAN:
return new Fp(curve, X1, Y1, new ECFieldElement[]{ Z1 });
case ECCurve.COORD_JACOBIAN_MODIFIED:
return new Fp(curve, X1, Y1, new ECFieldElement[]{ Z1, W1 });
default:
throw new IllegalStateException("unsupported coordinate system");
}
}
protected ECFieldElement two(ECFieldElement x)
{
return x.add(x);
}
protected ECFieldElement three(ECFieldElement x)
{
return two(x).add(x);
}
protected ECFieldElement four(ECFieldElement x)
{
return two(two(x));
}
protected ECFieldElement eight(ECFieldElement x)
{
return four(two(x));
}
protected ECFieldElement doubleProductFromSquares(ECFieldElement a, ECFieldElement b,
ECFieldElement aSquared, ECFieldElement bSquared)
{
/*
* NOTE: If squaring in the field is faster than multiplication, then this is a quicker
* way to calculate 2.A.B, if A^2 and B^2 are already known.
*/
return a.add(b).square().subtract(aSquared).subtract(bSquared);
}
public ECPoint negate()
{
if (this.isInfinity())
{
return this;
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
if (ECCurve.COORD_AFFINE != coord)
{
return new ECPoint.Fp(curve, this.x, this.y.negate(), this.zs);
}
return new ECPoint.Fp(curve, this.x, this.y.negate());
}
protected ECFieldElement calculateJacobianModifiedW(ECFieldElement Z, ECFieldElement ZSquared)
{
ECFieldElement a4 = this.getCurve().getA();
if (a4.isZero() || Z.isOne())
{
return a4;
}
if (ZSquared == null)
{
ZSquared = Z.square();
}
ECFieldElement W = ZSquared.square();
ECFieldElement a4Neg = a4.negate();
if (a4Neg.bitLength() < a4.bitLength())
{
W = W.multiply(a4Neg).negate();
}
else
{
W = W.multiply(a4);
}
return W;
}
protected ECFieldElement getJacobianModifiedW()
{
ECFieldElement W = this.zs[1];
if (W == null)
{
// NOTE: Rarely, twicePlus will result in the need for a lazy W1 calculation here
this.zs[1] = W = calculateJacobianModifiedW(this.zs[0], null);
}
return W;
}
protected ECPoint.Fp twiceJacobianModified(boolean calculateW)
{
ECFieldElement X1 = this.x, Y1 = this.y, Z1 = this.zs[0], W1 = getJacobianModifiedW();
ECFieldElement X1Squared = X1.square();
ECFieldElement M = three(X1Squared).add(W1);
ECFieldElement _2Y1 = two(Y1);
ECFieldElement _2Y1Squared = _2Y1.multiply(Y1);
ECFieldElement S = two(X1.multiply(_2Y1Squared));
ECFieldElement X3 = M.square().subtract(two(S));
ECFieldElement _4T = _2Y1Squared.square();
ECFieldElement _8T = two(_4T);
ECFieldElement Y3 = M.multiply(S.subtract(X3)).subtract(_8T);
ECFieldElement W3 = calculateW ? two(_8T.multiply(W1)) : null;
ECFieldElement Z3 = Z1.isOne() ? _2Y1 : _2Y1.multiply(Z1);
return new ECPoint.Fp(this.getCurve(), X3, Y3, new ECFieldElement[]{ Z3, W3 });
}
}
public static abstract class AbstractF2m extends ECPoint
{
protected AbstractF2m(ECCurve curve, ECFieldElement x, ECFieldElement y)
{
super(curve, x, y);
}
protected AbstractF2m(ECCurve curve, ECFieldElement x, ECFieldElement y, ECFieldElement[] zs)
{
super(curve, x, y, zs);
}
protected boolean satisfiesCurveEquation()
{
ECCurve curve = this.getCurve();
ECFieldElement X = this.x, A = curve.getA(), B = curve.getB();
int coord = curve.getCoordinateSystem();
if (coord == ECCurve.COORD_LAMBDA_PROJECTIVE)
{
ECFieldElement Z = this.zs[0];
boolean ZIsOne = Z.isOne();
if (X.isZero())
{
// NOTE: For x == 0, we expect the affine-y instead of the lambda-y
ECFieldElement Y = this.y;
ECFieldElement lhs = Y.square(), rhs = B;
if (!ZIsOne)
{
rhs = rhs.multiply(Z.square());
}
return lhs.equals(rhs);
}
ECFieldElement L = this.y, X2 = X.square();
ECFieldElement lhs, rhs;
if (ZIsOne)
{
lhs = L.square().add(L).add(A);
rhs = X2.square().add(B);
}
else
{
ECFieldElement Z2 = Z.square(), Z4 = Z2.square();
lhs = L.add(Z).multiplyPlusProduct(L, A, Z2);
// TODO If sqrt(b) is precomputed this can be simplified to a single square
rhs = X2.squarePlusProduct(B, Z4);
}
lhs = lhs.multiply(X2);
return lhs.equals(rhs);
}
ECFieldElement Y = this.y;
ECFieldElement lhs = Y.add(X).multiply(Y);
switch (coord)
{
case ECCurve.COORD_AFFINE:
break;
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Z = this.zs[0];
if (!Z.isOne())
{
ECFieldElement Z2 = Z.square(), Z3 = Z.multiply(Z2);
lhs = lhs.multiply(Z);
A = A.multiply(Z);
B = B.multiply(Z3);
}
break;
}
default:
throw new IllegalStateException("unsupported coordinate system");
}
ECFieldElement rhs = X.add(A).multiply(X.square()).add(B);
return lhs.equals(rhs);
}
protected boolean satisfiesOrder()
{
BigInteger cofactor = curve.getCofactor();
if (ECConstants.TWO.equals(cofactor))
{
/*
* Check that 0 == Tr(X + A); then there exists a solution to L^2 + L = X + A, and
* so a halving is possible, so this point is the double of another.
*
* Note: Tr(A) == 1 for cofactor 2 curves.
*/
ECPoint N = this.normalize();
ECFieldElement X = N.getAffineXCoord();
return 0 != ((ECFieldElement.AbstractF2m)X).trace();
}
if (ECConstants.FOUR.equals(cofactor))
{
/*
* Solve L^2 + L = X + A to find the half of this point, if it exists (fail if not).
*
* Note: Tr(A) == 0 for cofactor 4 curves.
*/
ECPoint N = this.normalize();
ECFieldElement X = N.getAffineXCoord();
ECFieldElement L = ((ECCurve.AbstractF2m)curve).solveQuadraticEquation(X.add(curve.getA()));
if (null == L)
{
return false;
}
/*
* A solution exists, therefore 0 == Tr(X + A) == Tr(X).
*/
ECFieldElement Y = N.getAffineYCoord();
ECFieldElement T = X.multiply(L).add(Y);
/*
* Either T or (T + X) is the square of a half-point's x coordinate (hx). In either
* case, the half-point can be halved again when 0 == Tr(hx + A).
*
* Note: Tr(hx + A) == Tr(hx) == Tr(hx^2) == Tr(T) == Tr(T + X)
*
* Check that 0 == Tr(T); then there exists a solution to L^2 + L = hx + A, and so a
* second halving is possible and this point is four times some other.
*/
return 0 == ((ECFieldElement.AbstractF2m)T).trace();
}
return super.satisfiesOrder();
}
public ECPoint scaleX(ECFieldElement scale)
{
if (this.isInfinity())
{
return this;
}
int coord = this.getCurveCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_LAMBDA_AFFINE:
{
// Y is actually Lambda (X + Y/X) here
ECFieldElement X = this.getRawXCoord(), L = this.getRawYCoord(); // earlier JDK
ECFieldElement X2 = X.multiply(scale);
ECFieldElement L2 = L.add(X).divide(scale).add(X2);
return this.getCurve().createRawPoint(X, L2, this.getRawZCoords()); // earlier JDK
}
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
// Y is actually Lambda (X + Y/X) here
ECFieldElement X = this.getRawXCoord(), L = this.getRawYCoord(), Z = this.getRawZCoords()[0]; // earlier JDK
// We scale the Z coordinate also, to avoid an inversion
ECFieldElement X2 = X.multiply(scale.square());
ECFieldElement L2 = L.add(X).add(X2);
ECFieldElement Z2 = Z.multiply(scale);
return this.getCurve().createRawPoint(X2, L2, new ECFieldElement[]{ Z2 }); // earlier JDK
}
default:
{
return super.scaleX(scale);
}
}
}
public ECPoint scaleXNegateY(ECFieldElement scale)
{
return scaleX(scale);
}
public ECPoint scaleY(ECFieldElement scale)
{
if (this.isInfinity())
{
return this;
}
int coord = this.getCurveCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_LAMBDA_AFFINE:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
ECFieldElement X = this.getRawXCoord(), L = this.getRawYCoord(); // earlier JDK
// Y is actually Lambda (X + Y/X) here
ECFieldElement L2 = L.add(X).multiply(scale).add(X);
return this.getCurve().createRawPoint(X, L2, this.getRawZCoords()); // earlier JDK
}
default:
{
return super.scaleY(scale);
}
}
}
public ECPoint scaleYNegateX(ECFieldElement scale)
{
return scaleY(scale);
}
public ECPoint subtract(ECPoint b)
{
if (b.isInfinity())
{
return this;
}
// Add -b
return this.add(b.negate());
}
public ECPoint.AbstractF2m tau()
{
if (this.isInfinity())
{
return this;
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
ECFieldElement X1 = this.x;
switch (coord)
{
case ECCurve.COORD_AFFINE:
case ECCurve.COORD_LAMBDA_AFFINE:
{
ECFieldElement Y1 = this.y;
return (ECPoint.AbstractF2m)curve.createRawPoint(X1.square(), Y1.square());
}
case ECCurve.COORD_HOMOGENEOUS:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
ECFieldElement Y1 = this.y, Z1 = this.zs[0];
return (ECPoint.AbstractF2m)curve.createRawPoint(X1.square(), Y1.square(),
new ECFieldElement[]{ Z1.square() });
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
public ECPoint.AbstractF2m tauPow(int pow)
{
if (this.isInfinity())
{
return this;
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
ECFieldElement X1 = this.x;
switch (coord)
{
case ECCurve.COORD_AFFINE:
case ECCurve.COORD_LAMBDA_AFFINE:
{
ECFieldElement Y1 = this.y;
return (ECPoint.AbstractF2m)curve.createRawPoint(X1.squarePow(pow), Y1.squarePow(pow));
}
case ECCurve.COORD_HOMOGENEOUS:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
ECFieldElement Y1 = this.y, Z1 = this.zs[0];
return (ECPoint.AbstractF2m)curve.createRawPoint(X1.squarePow(pow), Y1.squarePow(pow),
new ECFieldElement[]{ Z1.squarePow(pow) });
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
}
/**
* Elliptic curve points over F2m
*/
public static class F2m extends AbstractF2m
{
F2m(ECCurve curve, ECFieldElement x, ECFieldElement y)
{
super(curve, x, y);
// checkCurveEquation();
}
F2m(ECCurve curve, ECFieldElement x, ECFieldElement y, ECFieldElement[] zs)
{
super(curve, x, y, zs);
// checkCurveEquation();
}
protected ECPoint detach()
{
return new ECPoint.F2m(null, this.getAffineXCoord(), this.getAffineYCoord()); // earlier JDK
}
public ECFieldElement getYCoord()
{
int coord = this.getCurveCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_LAMBDA_AFFINE:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
ECFieldElement X = x, L = y;
if (this.isInfinity() || X.isZero())
{
return L;
}
// Y is actually Lambda (X + Y/X) here; convert to affine value on the fly
ECFieldElement Y = L.add(X).multiply(X);
if (ECCurve.COORD_LAMBDA_PROJECTIVE == coord)
{
ECFieldElement Z = zs[0];
if (!Z.isOne())
{
Y = Y.divide(Z);
}
}
return Y;
}
default:
{
return y;
}
}
}
protected boolean getCompressionYTilde()
{
ECFieldElement X = this.getRawXCoord();
if (X.isZero())
{
return false;
}
ECFieldElement Y = this.getRawYCoord();
switch (this.getCurveCoordinateSystem())
{
case ECCurve.COORD_LAMBDA_AFFINE:
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
// Y is actually Lambda (X + Y/X) here
return Y.testBitZero() != X.testBitZero();
}
default:
{
return Y.divide(X).testBitZero();
}
}
}
public ECPoint add(ECPoint b)
{
if (this.isInfinity())
{
return b;
}
if (b.isInfinity())
{
return this;
}
ECCurve curve = this.getCurve();
int coord = curve.getCoordinateSystem();
ECFieldElement X1 = this.x;
ECFieldElement X2 = b.x;
switch (coord)
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement Y1 = this.y;
ECFieldElement Y2 = b.y;
ECFieldElement dx = X1.add(X2), dy = Y1.add(Y2);
if (dx.isZero())
{
if (dy.isZero())
{
return twice();
}
return curve.getInfinity();
}
ECFieldElement L = dy.divide(dx);
ECFieldElement X3 = L.square().add(L).add(dx).add(curve.getA());
ECFieldElement Y3 = L.multiply(X1.add(X3)).add(X3).add(Y1);
return new ECPoint.F2m(curve, X3, Y3);
}
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Y1 = this.y, Z1 = this.zs[0];
ECFieldElement Y2 = b.y, Z2 = b.zs[0];
boolean Z2IsOne = Z2.isOne();
ECFieldElement U1 = Z1.multiply(Y2);
ECFieldElement U2 = Z2IsOne ? Y1 : Y1.multiply(Z2);
ECFieldElement U = U1.add(U2);
ECFieldElement V1 = Z1.multiply(X2);
ECFieldElement V2 = Z2IsOne ? X1 : X1.multiply(Z2);
ECFieldElement V = V1.add(V2);
if (V.isZero())
{
if (U.isZero())
{
return twice();
}
return curve.getInfinity();
}
ECFieldElement VSq = V.square();
ECFieldElement VCu = VSq.multiply(V);
ECFieldElement W = Z2IsOne ? Z1 : Z1.multiply(Z2);
ECFieldElement uv = U.add(V);
ECFieldElement A = uv.multiplyPlusProduct(U, VSq, curve.getA()).multiply(W).add(VCu);
ECFieldElement X3 = V.multiply(A);
ECFieldElement VSqZ2 = Z2IsOne ? VSq : VSq.multiply(Z2);
ECFieldElement Y3 = U.multiplyPlusProduct(X1, V, Y1).multiplyPlusProduct(VSqZ2, uv, A);
ECFieldElement Z3 = VCu.multiply(W);
return new ECPoint.F2m(curve, X3, Y3, new ECFieldElement[]{ Z3 });
}
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
if (X1.isZero())
{
if (X2.isZero())
{
return curve.getInfinity();
}
return b.add(this);
}
ECFieldElement L1 = this.y, Z1 = this.zs[0];
ECFieldElement L2 = b.y, Z2 = b.zs[0];
boolean Z1IsOne = Z1.isOne();
ECFieldElement U2 = X2, S2 = L2;
if (!Z1IsOne)
{
U2 = U2.multiply(Z1);
S2 = S2.multiply(Z1);
}
boolean Z2IsOne = Z2.isOne();
ECFieldElement U1 = X1, S1 = L1;
if (!Z2IsOne)
{
U1 = U1.multiply(Z2);
S1 = S1.multiply(Z2);
}
ECFieldElement A = S1.add(S2);
ECFieldElement B = U1.add(U2);
if (B.isZero())
{
if (A.isZero())
{
return twice();
}
return curve.getInfinity();
}
ECFieldElement X3, L3, Z3;
if (X2.isZero())
{
// TODO This can probably be optimized quite a bit
ECPoint p = this.normalize();
X1 = p.getXCoord();
ECFieldElement Y1 = p.getYCoord();
ECFieldElement Y2 = L2;
ECFieldElement L = Y1.add(Y2).divide(X1);
X3 = L.square().add(L).add(X1).add(curve.getA());
if (X3.isZero())
{
return new ECPoint.F2m(curve, X3, curve.getB().sqrt());
}
ECFieldElement Y3 = L.multiply(X1.add(X3)).add(X3).add(Y1);
L3 = Y3.divide(X3).add(X3);
Z3 = curve.fromBigInteger(ECConstants.ONE);
}
else
{
B = B.square();
ECFieldElement AU1 = A.multiply(U1);
ECFieldElement AU2 = A.multiply(U2);
X3 = AU1.multiply(AU2);
if (X3.isZero())
{
return new ECPoint.F2m(curve, X3, curve.getB().sqrt());
}
ECFieldElement ABZ2 = A.multiply(B);
if (!Z2IsOne)
{
ABZ2 = ABZ2.multiply(Z2);
}
L3 = AU2.add(B).squarePlusProduct(ABZ2, L1.add(Z1));
Z3 = ABZ2;
if (!Z1IsOne)
{
Z3 = Z3.multiply(Z1);
}
}
return new ECPoint.F2m(curve, X3, L3, new ECFieldElement[]{ Z3 });
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
public ECPoint twice()
{
if (this.isInfinity())
{
return this;
}
ECCurve curve = this.getCurve();
ECFieldElement X1 = this.x;
if (X1.isZero())
{
// A point with X == 0 is its own additive inverse
return curve.getInfinity();
}
int coord = curve.getCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement Y1 = this.y;
ECFieldElement L1 = Y1.divide(X1).add(X1);
ECFieldElement X3 = L1.square().add(L1).add(curve.getA());
ECFieldElement Y3 = X1.squarePlusProduct(X3, L1.addOne());
return new ECPoint.F2m(curve, X3, Y3);
}
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Y1 = this.y, Z1 = this.zs[0];
boolean Z1IsOne = Z1.isOne();
ECFieldElement X1Z1 = Z1IsOne ? X1 : X1.multiply(Z1);
ECFieldElement Y1Z1 = Z1IsOne ? Y1 : Y1.multiply(Z1);
ECFieldElement X1Sq = X1.square();
ECFieldElement S = X1Sq.add(Y1Z1);
ECFieldElement V = X1Z1;
ECFieldElement vSquared = V.square();
ECFieldElement sv = S.add(V);
ECFieldElement h = sv.multiplyPlusProduct(S, vSquared, curve.getA());
ECFieldElement X3 = V.multiply(h);
ECFieldElement Y3 = X1Sq.square().multiplyPlusProduct(V, h, sv);
ECFieldElement Z3 = V.multiply(vSquared);
return new ECPoint.F2m(curve, X3, Y3, new ECFieldElement[]{ Z3 });
}
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
ECFieldElement L1 = this.y, Z1 = this.zs[0];
boolean Z1IsOne = Z1.isOne();
ECFieldElement L1Z1 = Z1IsOne ? L1 : L1.multiply(Z1);
ECFieldElement Z1Sq = Z1IsOne ? Z1 : Z1.square();
ECFieldElement a = curve.getA();
ECFieldElement aZ1Sq = Z1IsOne ? a : a.multiply(Z1Sq);
ECFieldElement T = L1.square().add(L1Z1).add(aZ1Sq);
if (T.isZero())
{
return new ECPoint.F2m(curve, T, curve.getB().sqrt());
}
ECFieldElement X3 = T.square();
ECFieldElement Z3 = Z1IsOne ? T : T.multiply(Z1Sq);
ECFieldElement b = curve.getB();
ECFieldElement L3;
if (b.bitLength() < (curve.getFieldSize() >> 1))
{
ECFieldElement t1 = L1.add(X1).square();
ECFieldElement t2;
if (b.isOne())
{
t2 = aZ1Sq.add(Z1Sq).square();
}
else
{
// TODO Can be calculated with one square if we pre-compute sqrt(b)
t2 = aZ1Sq.squarePlusProduct(b, Z1Sq.square());
}
L3 = t1.add(T).add(Z1Sq).multiply(t1).add(t2).add(X3);
if (a.isZero())
{
L3 = L3.add(Z3);
}
else if (!a.isOne())
{
L3 = L3.add(a.addOne().multiply(Z3));
}
}
else
{
ECFieldElement X1Z1 = Z1IsOne ? X1 : X1.multiply(Z1);
L3 = X1Z1.squarePlusProduct(T, L1Z1).add(X3).add(Z3);
}
return new ECPoint.F2m(curve, X3, L3, new ECFieldElement[]{ Z3 });
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
public ECPoint twicePlus(ECPoint b)
{
if (this.isInfinity())
{
return b;
}
if (b.isInfinity())
{
return twice();
}
ECCurve curve = this.getCurve();
ECFieldElement X1 = this.x;
if (X1.isZero())
{
// A point with X == 0 is its own additive inverse
return b;
}
int coord = curve.getCoordinateSystem();
switch (coord)
{
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
// NOTE: twicePlus() only optimized for lambda-affine argument
ECFieldElement X2 = b.x, Z2 = b.zs[0];
if (X2.isZero() || !Z2.isOne())
{
return twice().add(b);
}
ECFieldElement L1 = this.y, Z1 = this.zs[0];
ECFieldElement L2 = b.y;
ECFieldElement X1Sq = X1.square();
ECFieldElement L1Sq = L1.square();
ECFieldElement Z1Sq = Z1.square();
ECFieldElement L1Z1 = L1.multiply(Z1);
ECFieldElement T = curve.getA().multiply(Z1Sq).add(L1Sq).add(L1Z1);
ECFieldElement L2plus1 = L2.addOne();
ECFieldElement A = curve.getA().add(L2plus1).multiply(Z1Sq).add(L1Sq).multiplyPlusProduct(T, X1Sq, Z1Sq);
ECFieldElement X2Z1Sq = X2.multiply(Z1Sq);
ECFieldElement B = X2Z1Sq.add(T).square();
if (B.isZero())
{
if (A.isZero())
{
return b.twice();
}
return curve.getInfinity();
}
if (A.isZero())
{
return new ECPoint.F2m(curve, A, curve.getB().sqrt());
}
ECFieldElement X3 = A.square().multiply(X2Z1Sq);
ECFieldElement Z3 = A.multiply(B).multiply(Z1Sq);
ECFieldElement L3 = A.add(B).square().multiplyPlusProduct(T, L2plus1, Z3);
return new ECPoint.F2m(curve, X3, L3, new ECFieldElement[]{ Z3 });
}
default:
{
return twice().add(b);
}
}
}
public ECPoint negate()
{
if (this.isInfinity())
{
return this;
}
ECFieldElement X = this.x;
if (X.isZero())
{
return this;
}
switch (this.getCurveCoordinateSystem())
{
case ECCurve.COORD_AFFINE:
{
ECFieldElement Y = this.y;
return new ECPoint.F2m(curve, X, Y.add(X));
}
case ECCurve.COORD_HOMOGENEOUS:
{
ECFieldElement Y = this.y, Z = this.zs[0];
return new ECPoint.F2m(curve, X, Y.add(X), new ECFieldElement[]{ Z });
}
case ECCurve.COORD_LAMBDA_AFFINE:
{
ECFieldElement L = this.y;
return new ECPoint.F2m(curve, X, L.addOne());
}
case ECCurve.COORD_LAMBDA_PROJECTIVE:
{
// L is actually Lambda (X + Y/X) here
ECFieldElement L = this.y, Z = this.zs[0];
return new ECPoint.F2m(curve, X, L.add(Z), new ECFieldElement[]{ Z });
}
default:
{
throw new IllegalStateException("unsupported coordinate system");
}
}
}
}
}