X-Git-Url: https://www.bearssl.org/gitweb//home/git/?p=BearSSL;a=blobdiff_plain;f=inc%2Fbearssl_ec.h;h=1ecb4cdcffe54b9347cc9f3454e0773c63e8c31e;hp=69ad29ef11ec2b67735b4ccfd3770b0c9058a517;hb=693d2a0085f4c1d289cb6d79c02ddd23f18d9478;hpb=28e4e120b84dacdf53963639f1a8a6fec2793662

diff --git a/inc/bearssl_ec.h b/inc/bearssl_ec.h
index 69ad29e..1ecb4cd 100644
--- a/inc/bearssl_ec.h
+++ b/inc/bearssl_ec.h
@@ -69,6 +69,11 @@
  *
  *      Multiply a curve point with an integer.
  *
+ *   - `mulgen()`
+ *
+ *      Multiply the curve generator with an integer. This may be faster
+ *      than the generic `mul()`.
+ *
  *   - `muladd()`
  *
  *      Multiply two curve points by two integers, and return the sum of
@@ -213,6 +218,12 @@
 /** \brief Identifier for named curve brainpoolP512r1. */
 #define BR_EC_brainpoolP512r1    28
 
+/** \brief Identifier for named curve Curve25519. */
+#define BR_EC_curve25519         29
+
+/** \brief Identifier for named curve Curve448. */
+#define BR_EC_curve448           30
+
 /**
  * \brief Structure for an EC public key.
  */
@@ -299,10 +310,9 @@ typedef struct {
 	 *     not the case, then this function returns an error (0).
 	 *
 	 *   - The multiplier integer MUST be non-zero and less than the
-	 *     curve subgroup order. If the integer is zero, then an
-	 *     error is reported, but if the integer is not lower than
-	 *     the subgroup order, then the result is indeterminate and an
-	 *     error code is not guaranteed.
+	 *     curve subgroup order. If this property does not hold, then
+	 *     the result is indeterminate and an error code is not
+	 *     guaranteed.
 	 *
 	 * Returned value is 1 on success, 0 on error. On error, the
 	 * contents of `G` are indeterminate.
@@ -317,6 +327,22 @@ typedef struct {
 	uint32_t (*mul)(unsigned char *G, size_t Glen,
 		const unsigned char *x, size_t xlen, int curve);
 
+	/**
+	 * \brief Multiply the generator by an integer.
+	 *
+	 * The multiplier MUST be non-zero and less than the curve
+	 * subgroup order. Results are indeterminate if this property
+	 * does not hold.
+	 *
+	 * \param R       output buffer for the point.
+	 * \param x       multiplier (unsigned big-endian).
+	 * \param xlen    multiplier length (in bytes).
+	 * \param curve   curve identifier.
+	 * \return  encoded result point length (in bytes).
+	 */
+	size_t (*mulgen)(unsigned char *R,
+		const unsigned char *x, size_t xlen, int curve);
+
 	/**
 	 * \brief Multiply two points by two integers and add the
 	 * results.
@@ -333,6 +359,11 @@ typedef struct {
 	 *     infinity" either). If this is not the case, then this
 	 *     function returns an error (0).
 	 *
+	 *   - If the `B` pointer is `NULL`, then the conventional
+	 *     subgroup generator is used. With some implementations,
+	 *     this may be faster than providing a pointer to the
+	 *     generator.
+	 *
 	 *   - The multiplier integers (`x` and `y`) MUST be non-zero
 	 *     and less than the curve subgroup order. If either integer
 	 *     is zero, then an error is reported, but if one of them is
@@ -346,7 +377,7 @@ typedef struct {
 	 * contents of `A` are indeterminate.
 	 *
 	 * \param A       first point to multiply.
-	 * \param B       second point to multiply.
+	 * \param B       second point to multiply (`NULL` for the generator).
 	 * \param len     common length of the encoded points (in bytes).
 	 * \param x       multiplier for `A` (unsigned big-endian).
 	 * \param xlen    length of multiplier for `A` (in bytes).
@@ -379,14 +410,31 @@ extern const br_ec_impl br_ec_prime_i31;
 extern const br_ec_impl br_ec_prime_i15;
 
 /**
- * \brief EC implementation "i15" for P-256.
+ * \brief EC implementation "m15" for P-256.
  *
  * This implementation uses specialised code for curve secp256r1 (also
- * known as NIST P-256), with Karatsuba decomposition, and fast modular
- * reduction thanks to the field modulus special format. Only 32-bit
- * multiplications are used (with 32-bit results, not 64-bit).
+ * known as NIST P-256), with optional Karatsuba decomposition, and fast
+ * modular reduction thanks to the field modulus special format. Only
+ * 32-bit multiplications are used (with 32-bit results, not 64-bit).
+ */
+extern const br_ec_impl br_ec_p256_m15;
+
+/**
+ * \brief EC implementation "i15" (generic code) for Curve25519.
+ *
+ * This implementation uses the generic code for modular integers (with
+ * 15-bit words) to support Curve25519. The `muladd()` method is not
+ * implemented.
+ */
+extern const br_ec_impl br_ec_c25519_i15;
+
+/**
+ * \brief EC implementation "m15" (specialised code) for Curve25519.
+ *
+ * This implementation uses custom code relying on multiplication of
+ * integers up to 15 bits. The `muladd()` method is not implemented.
  */
-extern const br_ec_impl br_ec_p256_i15;
+extern const br_ec_impl br_ec_c25519_m15;
 
 /**
  * \brief Convert a signature from "raw" to "asn1".