jni/libzrtp/sources/bnlib/ec/ec.c - jami-client-android - Gitiles

 /*
  * Copyright (C) 2012 Werner Dittmann
  * All rights reserved. For licensing and other legal details, see the file legal.c.
  *
  * @author Werner Dittmann <Werner.Dittmann@t-online.de>
  *
  */
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>

 #include <bn.h>
 #include <bnprint.h>

 #include <ec/ec.h>

 static BigNum _mpiZero;
 static BigNum _mpiOne;
 static BigNum _mpiTwo;
 static BigNum _mpiThree;
 static BigNum _mpiFour;
 static BigNum _mpiEight;

 static BigNum* mpiZero  = &_mpiZero;
 static BigNum* mpiOne   = &_mpiOne;
 static BigNum* mpiTwo   = &_mpiTwo;
 static BigNum* mpiThree = &_mpiThree;
 static BigNum* mpiFour  = &_mpiFour;
 static BigNum* mpiEight = &_mpiEight;
 static int initialized = 0;


 /* The following parameters are given:
  - The prime modulus p
  - The order n
  - The 160-bit input seed SEED to the SHA-1 based algorithm (i.e., the domain parameter seed)
  - The output c of the SHA-1 based algorithm
  - The coefficient b (satisfying b2 c ≡ –27 (mod p))
  - The base point x coordinate Gx
  - The base point y coordinate Gy
 */

 typedef struct _curveData {
     char *p;
     char *n;
     char *SEED;
     char *c;
     char *b;
     char *Gx;
     char *Gy;
 } curveData;

 static curveData nist192 = {
     "6277101735386680763835789423207666416083908700390324961279",
     "6277101735386680763835789423176059013767194773182842284081",
     "3045ae6fc8422f64ed579528d38120eae12196d5",
     "3099d2bbbfcb2538542dcd5fb078b6ef5f3d6fe2c745de65",
     "64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1",
     "188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012",
     "07192b95ffc8da78631011ed6b24cdd573f977a11e794811",
 };

 static curveData nist224 = {
     "26959946667150639794667015087019630673557916260026308143510066298881",
     "26959946667150639794667015087019625940457807714424391721682722368061",
     "bd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5",
     "5b056c7e11dd68f40469ee7f3c7a7d74f7d121116506d031218291fb",
     "b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4",
     "b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
     "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
 };

 static curveData nist256 = {
     "115792089210356248762697446949407573530086143415290314195533631308867097853951",
     "115792089210356248762697446949407573529996955224135760342422259061068512044369",
     "c49d360886e704936a6678e1139d26b7819f7e90",
     "7efba1662985be9403cb055c75d4f7e0ce8d84a9c5114abcaf3177680104fa0d",
     "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
     "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
     "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
 };

 static curveData nist384 = {
     "39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319",
     "39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942643",
     "a335926aa319a27a1d00896a6773a4827acdac73",
     "79d1e655f868f02fff48dcdee14151ddb80643c1406d0ca10dfe6fc52009540a495e8042ea5f744f6e184667cc722483",
     "b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef",
     "aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7",
     "3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f",
 };

 static curveData nist521 = {
     "6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151",
     "6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449",
     "d09e8800291cb85396cc6717393284aaa0da64ba",
         "0b48bfa5f420a34949539d2bdfc264eeeeb077688e44fbf0ad8f6d0edb37bd6b533281000518e19f1b9ffbe0fe9ed8a3c2200b8f875e523868c70c1e5bf55bad637",
         "051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
          "c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
         "11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
 };

 /*============================================================================*/
 /*    Bignum Shorthand Functions                                              */
 /*============================================================================*/

 int bnAddMod_ (struct BigNum *rslt, struct BigNum *n1, struct BigNum *mod)
 {
     bnAdd (rslt, n1);
     if (bnCmp (rslt, mod) >= 0) {
         bnSub (rslt, mod);
     }
     return 0;
 }

 int bnAddQMod_ (struct BigNum *rslt, unsigned n1, struct BigNum *mod)
 {
     bnAddQ (rslt, n1);
     if (bnCmp (rslt, mod) >= 0) {
         bnSub (rslt, mod);
     }
     return 0;
 }

 int bnSubMod_ (struct BigNum *rslt, struct BigNum *n1, struct BigNum *mod)
 {
     if (bnCmp (rslt, n1) < 0) {
         bnAdd (rslt, mod);
     }
     bnSub (rslt, n1);
     return 0;
 }

 int bnSubQMod_ (struct BigNum *rslt, unsigned n1, struct BigNum *mod)
 {
     if (bnCmpQ (rslt, n1) < 0) {
         bnAdd (rslt, mod);
     }
     bnSubQ (rslt, n1);
     return 0;
 }

 int bnMulMod_ (struct BigNum *rslt, struct BigNum *n1, struct BigNum *n2, struct BigNum *mod)
 {
     bnMul (rslt, n1, n2);
     bnMod (rslt, rslt, mod);
     return 0;
 }

 int bnMulQMod_ (struct BigNum *rslt, struct BigNum *n1, unsigned n2, struct BigNum *mod)
 {
     bnMulQ (rslt, n1, n2);
     bnMod (rslt, rslt, mod);
     return 0;
 }

 int bnSquareMod_ (struct BigNum *rslt, struct BigNum *n1, struct BigNum *mod)
 {
     bnSquare (rslt, n1);
     bnMod (rslt, rslt, mod);
     return 0;
 }

 int ecGetCurveNistECp(NistCurves curveId, NistECpCurve *curve)
 {
     size_t maxBits;
     curveData *cd;

     if (!initialized) {
         bnBegin(mpiZero); bnSetQ(mpiZero, 0);
         bnBegin(mpiOne); bnSetQ(mpiOne, 1);
         bnBegin(mpiTwo); bnSetQ(mpiTwo, 2);
         bnBegin(mpiThree); bnSetQ(mpiThree, 3);
         bnBegin(mpiFour); bnSetQ(mpiFour, 4);
         bnBegin(mpiEight); bnSetQ(mpiEight, 8);
         initialized = 1;
     }
     if (curve == NULL)
         return -2;

     bnBegin(&curve->_p);    curve->p = &curve->_p;
     bnBegin(&curve->_n);    curve->n = &curve->_n;
     bnBegin(&curve->_SEED); curve->SEED = &curve->_SEED;
     bnBegin(&curve->_c);    curve->c = &curve->_c;
     bnBegin(&curve->_a);    curve->a = &curve->_a;
     bnBegin(&curve->_b);    curve->b = &curve->_b;
     bnBegin(&curve->_Gx);   curve->Gx = &curve->_Gx;
     bnBegin(&curve->_Gy);   curve->Gy = &curve->_Gy;

     /* Initialize scratchpad variables and their pointers */
     bnBegin(&curve->_S1); curve->S1 = &curve->_S1;
     bnBegin(&curve->_U1); curve->U1 = &curve->_U1;
     bnBegin(&curve->_H);  curve->H = &curve->_H;
     bnBegin(&curve->_R);  curve->R = &curve->_R;
     bnBegin(&curve->_t0); curve->t0 = &curve->_t0;
     bnBegin(&curve->_t1); curve->t1 = &curve->_t1;
     bnBegin(&curve->_t2); curve->t2 = &curve->_t2;
     bnBegin(&curve->_t3); curve->t3 = &curve->_t3;

     switch (curveId) {
     case NIST192P:
         cd = &nist192;
         break;

     case NIST224P:
         cd = &nist224;
         break;

     case NIST256P:
         cd = &nist256;
         break;

     case NIST384P:
         cd = &nist384;
         break;

     case NIST521P:
         cd = &nist521;
         break;

     default:
         return -2;
     }

     bnReadAscii(curve->p, cd->p, 10);
     bnReadAscii(curve->n, cd->n, 10);
     bnReadAscii(curve->SEED, cd->SEED, 16);
     bnReadAscii(curve->c, cd->c, 16);
     bnCopy(curve->a, curve->p);
     bnSub(curve->a, mpiThree);
     bnReadAscii(curve->b, cd->b, 16);
     bnReadAscii(curve->Gx, cd->Gx, 16);
     bnReadAscii(curve->Gy, cd->Gy, 16);

     /* variables must be able to hold p^2, plus one nimb (min. 15 bits) for overflow */
     maxBits = bnBits(curve->p) * 2 + 15;

     /* The set_bit allocates enough memory to hold maximum values */
     /* Initialize scratchpad variables before use */
     bnPrealloc(curve->S1, maxBits);
     bnPrealloc(curve->U1, maxBits);
     bnPrealloc(curve->H, maxBits);
     bnPrealloc(curve->R, maxBits);
     bnPrealloc(curve->S1, maxBits);
     bnPrealloc(curve->t1, maxBits);
     bnPrealloc(curve->t2, maxBits);
     bnPrealloc(curve->t3, maxBits);

     return 0;

 /*     ecFreeCurveNistECp(curve);
      return ret;
 */
 }


 void ecFreeCurveNistECp(NistECpCurve *curve)
 {
     if (curve == NULL)
         return;

     bnEnd(curve->p);
     bnEnd(curve->n);
     bnEnd(curve->SEED);
     bnEnd(curve->c);
     bnEnd(curve->b);
     bnEnd(curve->Gx);
     bnEnd(curve->Gy);

     bnEnd(curve->S1);
     bnEnd(curve->U1);
     bnEnd(curve->H);
     bnEnd(curve->R);
     bnEnd(curve->t0);
     bnEnd(curve->t1);
     bnEnd(curve->t2);
     bnEnd(curve->t3);
 }


 /*============================================================================*/
 /*    Elliptic Curve arithmetic                                               */
 /*============================================================================*/

 int ecGetAffine(const NistECpCurve *curve, EcPoint *R, const EcPoint *P)
 {
     int ret = 0;

     struct BigNum z_1, z_2;

     bnBegin(&z_1);
     bnBegin(&z_2);

     /* affine x = X / Z^2 */
     bnInv (&z_1, P->z, curve->p);          /* z_1 = Z^(-1) */
     bnMulMod_(&z_2, &z_1, &z_1, curve->p); /* z_2 = Z^(-2) */
     bnMulMod_(R->x, P->x, &z_2, curve->p);

     /* affine y = Y / Z^3 */
     bnMulMod_(&z_2, &z_2, &z_1, curve->p); /* z_2 = Z^(-3) */
     bnMulMod_(R->y, P->y, &z_2, curve->p);

     bnSetQ(R->z, 1);

     bnEnd(&z_1);
     bnEnd(&z_2);
     return ret;
 }

 int ecDoublePoint(const NistECpCurve *curve, EcPoint *R, const EcPoint *P)
 {
     int ret = 0;

     EcPoint tP;
     const EcPoint *ptP = 0;

     if (!bnCmp(P->y, mpiZero) || !bnCmp(P->z, mpiZero)) {
         bnSetQ(R->x, 1);
         bnSetQ(R->y, 1);
         bnSetQ(R->z, 0);
         return 0;
     }

     /* Check for overlapping arguments, copy if necessary and set pointer */
     if (P == R) {
         INIT_EC_POINT(&tP);
         ptP = &tP;
         bnCopy(tP.x, P->x);
         bnCopy(tP.y, P->y);
         bnCopy(tP.z, P->z);
     }
     else
         ptP = P;

     /* S = 4*X*Y^2, save Y^2 in t1 for later use */
     bnMulMod_(curve->t1, ptP->y, ptP->y, curve->p);       /* t1 = Y^2 */
     bnMulMod_(curve->t0, ptP->x, mpiFour, curve->p);      /* t0 = 4 * X */
     bnMulMod_(curve->S1, curve->t0, curve->t1, curve->p); /* S1 = t0 * t1 */

     /* M = 3*(X + Z^2)*(X - Z^2), use scratch variable U1 to store M value */
     bnMulMod_(curve->t2, ptP->z, ptP->z, curve->p);       /* t2 = Z^2 */
     bnCopy(curve->t0, ptP->x);
     bnAddMod_(curve->t0, curve->t2, curve->p);            /* t0 = X + t2  */
     bnMulMod_(curve->t3, curve->t0, mpiThree, curve->p);  /* t3 = 3 * t0 */
     bnCopy(curve->t0, ptP->x);
     bnSubMod_(curve->t0, curve->t2, curve->p);            /* t0 = X - t2 */
     bnMulMod_(curve->U1, curve->t3, curve->t0, curve->p); /* M = t3 * t0 */

     /* X' = M^2 - 2*S */
     bnMulMod_(curve->t2, curve->U1, curve->U1, curve->p); /* t2 = M^2 */
     bnMulMod_(curve->t0, curve->S1, mpiTwo, curve->p);    /* t0 = S * 2 */
     bnCopy(R->x, curve->t2);
     bnSubMod_(R->x, curve->t0, curve->p);                 /* X' = t2 - t0 */

     /* Y' = M*(S - X') - 8*Y^4 */
     bnMulMod_(curve->t3, curve->t1, curve->t1, curve->p); /* t3 = Y^4 (t1 saved above) */
     bnMulMod_(curve->t2, curve->t3, mpiEight, curve->p); /* t2 = t3 * 8 */
     bnCopy(curve->t3, curve->S1);
     bnSubMod_(curve->t3, R->x, curve->p);                 /* t3 = S - X' */
     bnMulMod_(curve->t0, curve->U1, curve->t3, curve->p); /* t0 = M * t3 */
     bnCopy(R->y, curve->t0);
     bnSubMod_(R->y, curve->t2, curve->p);                 /* Y' = t0 - t2 */

     /* Z' = 2*Y*Z */
     bnMulMod_(curve->t0, ptP->y, mpiTwo, curve->p);       /* t0 = 2 * Y */
     bnMulMod_(R->z, curve->t0, ptP->z, curve->p);         /* Z' = to * Z */

     if (P == R)
         FREE_EC_POINT(&tP);

     return ret;
 }

 /* Add two elliptic curve points. Any of them may be the same object. */
 int ecAddPoint(const NistECpCurve *curve, EcPoint *R, const EcPoint *P, const EcPoint *Q)
 {
     int ret = 0;

     EcPoint tP, tQ;
     const EcPoint *ptP = 0;
     const EcPoint *ptQ = 0;


     /* Fast check if application called add(R, P, P) */
     if (!bnCmp(P->x, Q->x) && !bnCmp(P->y, Q->y) && !bnCmp(P->z, Q->z)) {
         return ecDoublePoint(curve, R, P);
     }

     /* if P is (@,@), R = Q */
     if (!bnCmp(P->z, mpiZero)) {
         bnCopy(R->x, Q->x);
         bnCopy(R->y, Q->y);
         bnCopy(R->z, Q->z);
         return 0;
     }

     /* if Q is (@,@), R = P */
     if (!bnCmp(Q->z, mpiZero)) {
         bnCopy(R->x, P->x);
         bnCopy(R->y, P->y);
         bnCopy(R->z, P->z);
         return 0;
     }

     /* Check for overlapping arguments, copy if necessary and set pointers */
     if (P == R) {
         INIT_EC_POINT(&tP);
         ptP = &tP;
         bnCopy(tP.x, P->x);
         bnCopy(tP.y, P->y);
         bnCopy(tP.z, P->z);
     }
     else
         ptP = P;

     if (Q == R) {
         INIT_EC_POINT(&tQ);
         ptQ = &tQ;
         bnCopy(tQ.x, Q->x);
         bnCopy(tQ.y, Q->y);
         bnCopy(tQ.z, Q->z);
     }
     else
         ptQ = Q;

     /* U1 = X1*Z2^2, where X1: P->x, Z2: Q->z */
     bnMulMod_(curve->t1, ptQ->z, ptQ->z, curve->p);    /* t1 = Z2^2 */
     bnMulMod_(curve->U1, ptP->x, curve->t1, curve->p); /* U1 = X1 * z_2 */

     /* S1 = Y1*Z2^3, where Y1: P->y */
     bnMulMod_(curve->t1, curve->t1, ptQ->z, curve->p); /* t1 = Z2^3 */
     bnMulMod_(curve->S1, ptP->y, curve->t1, curve->p); /* S1 = Y1 * z_2 */

     /* U2 = X2*Z1^2, where X2: Q->x, Z1: P->z */
     bnMulMod_(curve->t1, ptP->z, ptP->z, curve->p);    /* t1 = Z1^2 */
     bnMulMod_(curve->H, ptQ->x, curve->t1, curve->p);  /* H = X2 * t1 (store U2 in H) */

     /* H = U2 - U1 */
     bnSubMod_(curve->H, curve->U1, curve->p);

     /* S2 = Y2*Z1^3, where Y2: Q->y */
     bnMulMod_(curve->t1, curve->t1, ptP->z, curve->p); /* t1 = Z1^3 */
     bnMulMod_(curve->R, ptQ->y, curve->t1, curve->p);  /* R = Y2 * t1 (store S2 in R) */

     /* R = S2 - S1 */
     bnSubMod_(curve->R, curve->S1, curve->p);

     /* if (U1 == U2), i.e H is zero */
     if (!bnCmp(curve->H, mpiZero)) {

         /* if (S1 != S2), i.e. R is _not_ zero: return infinity*/
         if (bnCmp(curve->R, mpiZero)) {
             bnSetQ(R->x, 1);
             bnSetQ(R->y, 1);
             bnSetQ(R->z, 0);
             return 0;
         }
         return ecDoublePoint(curve, R, P);
     }
     /* X3 = R^2 - H^3 - 2*U1*H^2, where X3: R->x */
     bnMulMod_(curve->t0, curve->H, curve->H, curve->p);   /* t0 = H^2 */
     bnMulMod_(curve->t1, curve->U1, curve->t0, curve->p); /* t1 = U1 * t0, (hold t1) */
     bnMulMod_(curve->t0, curve->t0, curve->H, curve->p);  /* t0 = H^3, (hold t0) */
     bnMulMod_(curve->t2, curve->R, curve->R, curve->p);   /* t2 = R^2 */
     bnCopy(curve->t3, curve->t2);
     bnSubMod_(curve->t3, curve->t0, curve->p);            /* t3 = t2 - t0, (-H^3)*/
     bnMulMod_(curve->t2, mpiTwo, curve->t1, curve->p);    /* t2 = 2 * t1 */
     bnCopy(R->x, curve->t3);
     bnSubMod_(R->x, curve->t2, curve->p);                 /* X3 = t3 - t2 */

     /* Y3 = R*(U1*H^2 - X3) - S1*H^3, where Y3: R->y */
     bnSubMod_(curve->t1, R->x, curve->p);                 /* t1 = t1 - X3, overwrites t1 now */
     bnMulMod_(curve->t2, curve->R, curve->t1, curve->p);  /* t2 = R * z_2 */
     bnMulMod_(curve->S1, curve->S1, curve->t0, curve->p); /* S1 = S1 * t0, (t0 has H^3) */
     bnCopy(R->y, curve->t2);
     bnSubMod_(R->y, curve->S1, curve->p);                 /* Y3 = t2 - S1 */

     /* Z3 = H*Z1*Z2, where Z1: P->z, Z2: Q->z, Z3: R->z */
     bnMulMod_(curve->t2, curve->H, P->z, curve->p);       /* t2 = H * Z1 */
     bnMulMod_(R->z, curve->t2, Q->z, curve->p);           /* Z3 = t2 * Z2 */

     if (P == R)
         FREE_EC_POINT(&tP);
     if (Q == R)
         FREE_EC_POINT(&tQ);
     return ret;
 }

 int ecMulPointScalar(const NistECpCurve *curve, EcPoint *R, const EcPoint *P, const BigNum *scalar)
 {

     /* MPI_CHK below macro requires a 'ret' variable and a cleanup label */
     int ret = 0;
     int i;
     int bits = bnBits(scalar);
     EcPoint n;

     INIT_EC_POINT(&n);
     bnCopy(n.x, P->x);
     bnCopy(n.y, P->y);
     bnCopy(n.z, P->z);

     bnSetQ(R->x, 0);
     bnSetQ(R->y, 0);
     bnSetQ(R->z, 0);

     for (i = 0; i < bits; i++) {
         if (bnReadBit(scalar, i))
             ecAddPoint(curve, R, R, &n);

         /*        ecAddPoint(curve, &n, &n, &n); */
         ecDoublePoint(curve, &n, &n);
     }
     FREE_EC_POINT(&n);
     return ret;
 }

 #ifdef WEAKRANDOM
 /*
  * A standard random number generator that uses the portable random() system function.
  *
  * This should be enhanced to use a better random generator
  */
 static int _random(unsigned char *output, size_t len)
 {
     size_t i;

     for(i = 0; i < len; ++i )
         output[i] = random();

     return( 0 );
 }
 #else
 #include <cryptcommon/ZrtpRandom.h>
 static int _random(unsigned char *output, size_t len)
 {
     return zrtp_getRandomData(output, len);
 }
 #endif

 int ecGenerateRandomNumber(const NistECpCurve *curve, BigNum *d)
 {
     BigNum c, nMinusOne;

     size_t randomBytes = ((bnBits(curve->n) + 64) + 7) / 8;

     uint8_t *ran = malloc(randomBytes);

     bnBegin(&c);
     bnBegin(&nMinusOne);

     bnCopy(&nMinusOne, curve->n);
     bnSubMod_(&nMinusOne, mpiOne, curve->p);

     bnSetQ(d, 0);

     while (!bnCmpQ(d, 0)) {
         /* use _random function */
         _random(ran, randomBytes);
         bnInsertBigBytes(&c, ran, 0, randomBytes);
         bnMod(d, &c, &nMinusOne);
         bnAddMod_(d, mpiOne, curve->p);
     }

     bnEnd(&c);
     bnEnd(&nMinusOne);
     free(ran);

     return 0;
 }
	/*
	* Copyright (C) 2012 Werner Dittmann
	* All rights reserved. For licensing and other legal details, see the file legal.c.
	*
	* @author Werner Dittmann <Werner.Dittmann@t-online.de>
	*
	*/
	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>

	#include <bn.h>
	#include <bnprint.h>

	#include <ec/ec.h>

	static BigNum _mpiZero;
	static BigNum _mpiOne;
	static BigNum _mpiTwo;
	static BigNum _mpiThree;
	static BigNum _mpiFour;
	static BigNum _mpiEight;

	static BigNum* mpiZero = &_mpiZero;
	static BigNum* mpiOne = &_mpiOne;
	static BigNum* mpiTwo = &_mpiTwo;
	static BigNum* mpiThree = &_mpiThree;
	static BigNum* mpiFour = &_mpiFour;
	static BigNum* mpiEight = &_mpiEight;
	static int initialized = 0;


	/* The following parameters are given:
	- The prime modulus p
	- The order n
	- The 160-bit input seed SEED to the SHA-1 based algorithm (i.e., the domain parameter seed)
	- The output c of the SHA-1 based algorithm
	- The coefficient b (satisfying b2 c ≡ –27 (mod p))
	- The base point x coordinate Gx
	- The base point y coordinate Gy
	*/

	typedef struct _curveData {
	char *p;
	char *n;
	char *SEED;
	char *c;
	char *b;
	char *Gx;
	char *Gy;
	} curveData;

	static curveData nist192 = {
	"6277101735386680763835789423207666416083908700390324961279",
	"6277101735386680763835789423176059013767194773182842284081",
	"3045ae6fc8422f64ed579528d38120eae12196d5",
	"3099d2bbbfcb2538542dcd5fb078b6ef5f3d6fe2c745de65",
	"64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1",
	"188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012",
	"07192b95ffc8da78631011ed6b24cdd573f977a11e794811",
	};

	static curveData nist224 = {
	"26959946667150639794667015087019630673557916260026308143510066298881",
	"26959946667150639794667015087019625940457807714424391721682722368061",
	"bd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5",
	"5b056c7e11dd68f40469ee7f3c7a7d74f7d121116506d031218291fb",
	"b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4",
	"b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
	"bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
	};

	static curveData nist256 = {
	"115792089210356248762697446949407573530086143415290314195533631308867097853951",
	"115792089210356248762697446949407573529996955224135760342422259061068512044369",
	"c49d360886e704936a6678e1139d26b7819f7e90",
	"7efba1662985be9403cb055c75d4f7e0ce8d84a9c5114abcaf3177680104fa0d",
	"5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
	"4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
	};

	static curveData nist384 = {
	"39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319",
	"39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942643",
	"a335926aa319a27a1d00896a6773a4827acdac73",
	"79d1e655f868f02fff48dcdee14151ddb80643c1406d0ca10dfe6fc52009540a495e8042ea5f744f6e184667cc722483",
	"b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef",
	"aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7",
	"3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f",
	};

	static curveData nist521 = {
	"6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151",
	"6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449",
	"d09e8800291cb85396cc6717393284aaa0da64ba",
	"0b48bfa5f420a34949539d2bdfc264eeeeb077688e44fbf0ad8f6d0edb37bd6b533281000518e19f1b9ffbe0fe9ed8a3c2200b8f875e523868c70c1e5bf55bad637",
	"051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
	"c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
	"11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
	};

	/============================================================================/
	/* Bignum Shorthand Functions */
	/============================================================================/

	int bnAddMod_ (struct BigNum rslt, struct BigNum n1, struct BigNum *mod)
	{
	bnAdd (rslt, n1);
	if (bnCmp (rslt, mod) >= 0) {
	bnSub (rslt, mod);
	}
	return 0;
	}

	int bnAddQMod_ (struct BigNum rslt, unsigned n1, struct BigNum mod)
	{
	bnAddQ (rslt, n1);
	if (bnCmp (rslt, mod) >= 0) {
	bnSub (rslt, mod);
	}
	return 0;
	}

	int bnSubMod_ (struct BigNum rslt, struct BigNum n1, struct BigNum *mod)
	{
	if (bnCmp (rslt, n1) < 0) {
	bnAdd (rslt, mod);
	}
	bnSub (rslt, n1);
	return 0;
	}

	int bnSubQMod_ (struct BigNum rslt, unsigned n1, struct BigNum mod)
	{
	if (bnCmpQ (rslt, n1) < 0) {
	bnAdd (rslt, mod);
	}
	bnSubQ (rslt, n1);
	return 0;
	}

	int bnMulMod_ (struct BigNum rslt, struct BigNum n1, struct BigNum n2, struct BigNum mod)
	{
	bnMul (rslt, n1, n2);
	bnMod (rslt, rslt, mod);
	return 0;
	}

	int bnMulQMod_ (struct BigNum rslt, struct BigNum n1, unsigned n2, struct BigNum *mod)
	{
	bnMulQ (rslt, n1, n2);
	bnMod (rslt, rslt, mod);
	return 0;
	}

	int bnSquareMod_ (struct BigNum rslt, struct BigNum n1, struct BigNum *mod)
	{
	bnSquare (rslt, n1);
	bnMod (rslt, rslt, mod);
	return 0;
	}

	int ecGetCurveNistECp(NistCurves curveId, NistECpCurve *curve)
	{
	size_t maxBits;
	curveData *cd;

	if (!initialized) {
	bnBegin(mpiZero); bnSetQ(mpiZero, 0);
	bnBegin(mpiOne); bnSetQ(mpiOne, 1);
	bnBegin(mpiTwo); bnSetQ(mpiTwo, 2);
	bnBegin(mpiThree); bnSetQ(mpiThree, 3);
	bnBegin(mpiFour); bnSetQ(mpiFour, 4);
	bnBegin(mpiEight); bnSetQ(mpiEight, 8);
	initialized = 1;
	}
	if (curve == NULL)
	return -2;

	bnBegin(&curve->_p); curve->p = &curve->_p;
	bnBegin(&curve->_n); curve->n = &curve->_n;
	bnBegin(&curve->_SEED); curve->SEED = &curve->_SEED;
	bnBegin(&curve->_c); curve->c = &curve->_c;
	bnBegin(&curve->_a); curve->a = &curve->_a;
	bnBegin(&curve->_b); curve->b = &curve->_b;
	bnBegin(&curve->_Gx); curve->Gx = &curve->_Gx;
	bnBegin(&curve->_Gy); curve->Gy = &curve->_Gy;

	/* Initialize scratchpad variables and their pointers */
	bnBegin(&curve->_S1); curve->S1 = &curve->_S1;
	bnBegin(&curve->_U1); curve->U1 = &curve->_U1;
	bnBegin(&curve->_H); curve->H = &curve->_H;
	bnBegin(&curve->_R); curve->R = &curve->_R;
	bnBegin(&curve->_t0); curve->t0 = &curve->_t0;
	bnBegin(&curve->_t1); curve->t1 = &curve->_t1;
	bnBegin(&curve->_t2); curve->t2 = &curve->_t2;
	bnBegin(&curve->_t3); curve->t3 = &curve->_t3;

	switch (curveId) {
	case NIST192P:
	cd = &nist192;
	break;

	case NIST224P:
	cd = &nist224;
	break;

	case NIST256P:
	cd = &nist256;
	break;

	case NIST384P:
	cd = &nist384;
	break;

	case NIST521P:
	cd = &nist521;
	break;

	default:
	return -2;
	}

	bnReadAscii(curve->p, cd->p, 10);
	bnReadAscii(curve->n, cd->n, 10);
	bnReadAscii(curve->SEED, cd->SEED, 16);
	bnReadAscii(curve->c, cd->c, 16);
	bnCopy(curve->a, curve->p);
	bnSub(curve->a, mpiThree);
	bnReadAscii(curve->b, cd->b, 16);
	bnReadAscii(curve->Gx, cd->Gx, 16);
	bnReadAscii(curve->Gy, cd->Gy, 16);

	/* variables must be able to hold p^2, plus one nimb (min. 15 bits) for overflow */
	maxBits = bnBits(curve->p) * 2 + 15;

	/* The set_bit allocates enough memory to hold maximum values */
	/* Initialize scratchpad variables before use */
	bnPrealloc(curve->S1, maxBits);
	bnPrealloc(curve->U1, maxBits);
	bnPrealloc(curve->H, maxBits);
	bnPrealloc(curve->R, maxBits);
	bnPrealloc(curve->S1, maxBits);
	bnPrealloc(curve->t1, maxBits);
	bnPrealloc(curve->t2, maxBits);
	bnPrealloc(curve->t3, maxBits);

	return 0;

	/* ecFreeCurveNistECp(curve);
	return ret;
	*/
	}


	void ecFreeCurveNistECp(NistECpCurve *curve)
	{
	if (curve == NULL)
	return;

	bnEnd(curve->p);
	bnEnd(curve->n);
	bnEnd(curve->SEED);
	bnEnd(curve->c);
	bnEnd(curve->b);
	bnEnd(curve->Gx);
	bnEnd(curve->Gy);

	bnEnd(curve->S1);
	bnEnd(curve->U1);
	bnEnd(curve->H);
	bnEnd(curve->R);
	bnEnd(curve->t0);
	bnEnd(curve->t1);
	bnEnd(curve->t2);
	bnEnd(curve->t3);
	}


	/============================================================================/
	/* Elliptic Curve arithmetic */
	/============================================================================/

	int ecGetAffine(const NistECpCurve curve, EcPoint R, const EcPoint *P)
	{
	int ret = 0;

	struct BigNum z_1, z_2;

	bnBegin(&z_1);
	bnBegin(&z_2);

	/* affine x = X / Z^2 */
	bnInv (&z_1, P->z, curve->p); /* z_1 = Z^(-1) */
	bnMulMod_(&z_2, &z_1, &z_1, curve->p); /* z_2 = Z^(-2) */
	bnMulMod_(R->x, P->x, &z_2, curve->p);

	/* affine y = Y / Z^3 */
	bnMulMod_(&z_2, &z_2, &z_1, curve->p); /* z_2 = Z^(-3) */
	bnMulMod_(R->y, P->y, &z_2, curve->p);

	bnSetQ(R->z, 1);

	bnEnd(&z_1);
	bnEnd(&z_2);
	return ret;
	}

	int ecDoublePoint(const NistECpCurve curve, EcPoint R, const EcPoint *P)
	{
	int ret = 0;

	EcPoint tP;
	const EcPoint *ptP = 0;

	if (!bnCmp(P->y, mpiZero) \|\| !bnCmp(P->z, mpiZero)) {
	bnSetQ(R->x, 1);
	bnSetQ(R->y, 1);
	bnSetQ(R->z, 0);
	return 0;
	}

	/* Check for overlapping arguments, copy if necessary and set pointer */
	if (P == R) {
	INIT_EC_POINT(&tP);
	ptP = &tP;
	bnCopy(tP.x, P->x);
	bnCopy(tP.y, P->y);
	bnCopy(tP.z, P->z);
	}
	else
	ptP = P;

	/* S = 4XY^2, save Y^2 in t1 for later use */
	bnMulMod_(curve->t1, ptP->y, ptP->y, curve->p); /* t1 = Y^2 */
	bnMulMod_(curve->t0, ptP->x, mpiFour, curve->p); /* t0 = 4 * X */
	bnMulMod_(curve->S1, curve->t0, curve->t1, curve->p); /* S1 = t0 * t1 */

	/* M = 3(X + Z^2)(X - Z^2), use scratch variable U1 to store M value */
	bnMulMod_(curve->t2, ptP->z, ptP->z, curve->p); /* t2 = Z^2 */
	bnCopy(curve->t0, ptP->x);
	bnAddMod_(curve->t0, curve->t2, curve->p); /* t0 = X + t2 */
	bnMulMod_(curve->t3, curve->t0, mpiThree, curve->p); /* t3 = 3 * t0 */
	bnCopy(curve->t0, ptP->x);
	bnSubMod_(curve->t0, curve->t2, curve->p); /* t0 = X - t2 */
	bnMulMod_(curve->U1, curve->t3, curve->t0, curve->p); /* M = t3 * t0 */

	/* X' = M^2 - 2S /
	bnMulMod_(curve->t2, curve->U1, curve->U1, curve->p); /* t2 = M^2 */
	bnMulMod_(curve->t0, curve->S1, mpiTwo, curve->p); /* t0 = S * 2 */
	bnCopy(R->x, curve->t2);
	bnSubMod_(R->x, curve->t0, curve->p); /* X' = t2 - t0 */

	/* Y' = M(S - X') - 8Y^4 */
	bnMulMod_(curve->t3, curve->t1, curve->t1, curve->p); /* t3 = Y^4 (t1 saved above) */
	bnMulMod_(curve->t2, curve->t3, mpiEight, curve->p); /* t2 = t3 * 8 */
	bnCopy(curve->t3, curve->S1);
	bnSubMod_(curve->t3, R->x, curve->p); /* t3 = S - X' */
	bnMulMod_(curve->t0, curve->U1, curve->t3, curve->p); /* t0 = M * t3 */
	bnCopy(R->y, curve->t0);
	bnSubMod_(R->y, curve->t2, curve->p); /* Y' = t0 - t2 */

	/* Z' = 2YZ */
	bnMulMod_(curve->t0, ptP->y, mpiTwo, curve->p); /* t0 = 2 * Y */
	bnMulMod_(R->z, curve->t0, ptP->z, curve->p); /* Z' = to * Z */

	if (P == R)
	FREE_EC_POINT(&tP);

	return ret;
	}

	/* Add two elliptic curve points. Any of them may be the same object. */
	int ecAddPoint(const NistECpCurve curve, EcPoint R, const EcPoint P, const EcPoint Q)
	{
	int ret = 0;

	EcPoint tP, tQ;
	const EcPoint *ptP = 0;
	const EcPoint *ptQ = 0;


	/* Fast check if application called add(R, P, P) */
	if (!bnCmp(P->x, Q->x) && !bnCmp(P->y, Q->y) && !bnCmp(P->z, Q->z)) {
	return ecDoublePoint(curve, R, P);
	}

	/* if P is (@,@), R = Q */
	if (!bnCmp(P->z, mpiZero)) {
	bnCopy(R->x, Q->x);
	bnCopy(R->y, Q->y);
	bnCopy(R->z, Q->z);
	return 0;
	}

	/* if Q is (@,@), R = P */
	if (!bnCmp(Q->z, mpiZero)) {
	bnCopy(R->x, P->x);
	bnCopy(R->y, P->y);
	bnCopy(R->z, P->z);
	return 0;
	}

	/* Check for overlapping arguments, copy if necessary and set pointers */
	if (P == R) {
	INIT_EC_POINT(&tP);
	ptP = &tP;
	bnCopy(tP.x, P->x);
	bnCopy(tP.y, P->y);
	bnCopy(tP.z, P->z);
	}
	else
	ptP = P;

	if (Q == R) {
	INIT_EC_POINT(&tQ);
	ptQ = &tQ;
	bnCopy(tQ.x, Q->x);
	bnCopy(tQ.y, Q->y);
	bnCopy(tQ.z, Q->z);
	}
	else
	ptQ = Q;

	/* U1 = X1Z2^2, where X1: P->x, Z2: Q->z /
	bnMulMod_(curve->t1, ptQ->z, ptQ->z, curve->p); /* t1 = Z2^2 */
	bnMulMod_(curve->U1, ptP->x, curve->t1, curve->p); /* U1 = X1 * z_2 */

	/* S1 = Y1Z2^3, where Y1: P->y /
	bnMulMod_(curve->t1, curve->t1, ptQ->z, curve->p); /* t1 = Z2^3 */
	bnMulMod_(curve->S1, ptP->y, curve->t1, curve->p); /* S1 = Y1 * z_2 */

	/* U2 = X2Z1^2, where X2: Q->x, Z1: P->z /
	bnMulMod_(curve->t1, ptP->z, ptP->z, curve->p); /* t1 = Z1^2 */
	bnMulMod_(curve->H, ptQ->x, curve->t1, curve->p); /* H = X2 * t1 (store U2 in H) */

	/* H = U2 - U1 */
	bnSubMod_(curve->H, curve->U1, curve->p);

	/* S2 = Y2Z1^3, where Y2: Q->y /
	bnMulMod_(curve->t1, curve->t1, ptP->z, curve->p); /* t1 = Z1^3 */
	bnMulMod_(curve->R, ptQ->y, curve->t1, curve->p); /* R = Y2 * t1 (store S2 in R) */

	/* R = S2 - S1 */
	bnSubMod_(curve->R, curve->S1, curve->p);

	/* if (U1 == U2), i.e H is zero */
	if (!bnCmp(curve->H, mpiZero)) {

	/* if (S1 != S2), i.e. R is _not_ zero: return infinity*/
	if (bnCmp(curve->R, mpiZero)) {
	bnSetQ(R->x, 1);
	bnSetQ(R->y, 1);
	bnSetQ(R->z, 0);
	return 0;
	}
	return ecDoublePoint(curve, R, P);
	}
	/* X3 = R^2 - H^3 - 2U1H^2, where X3: R->x */
	bnMulMod_(curve->t0, curve->H, curve->H, curve->p); /* t0 = H^2 */
	bnMulMod_(curve->t1, curve->U1, curve->t0, curve->p); /* t1 = U1 * t0, (hold t1) */
	bnMulMod_(curve->t0, curve->t0, curve->H, curve->p); /* t0 = H^3, (hold t0) */
	bnMulMod_(curve->t2, curve->R, curve->R, curve->p); /* t2 = R^2 */
	bnCopy(curve->t3, curve->t2);
	bnSubMod_(curve->t3, curve->t0, curve->p); /* t3 = t2 - t0, (-H^3)*/
	bnMulMod_(curve->t2, mpiTwo, curve->t1, curve->p); /* t2 = 2 * t1 */
	bnCopy(R->x, curve->t3);
	bnSubMod_(R->x, curve->t2, curve->p); /* X3 = t3 - t2 */

	/* Y3 = R(U1H^2 - X3) - S1H^3, where Y3: R->y /
	bnSubMod_(curve->t1, R->x, curve->p); /* t1 = t1 - X3, overwrites t1 now */
	bnMulMod_(curve->t2, curve->R, curve->t1, curve->p); /* t2 = R * z_2 */
	bnMulMod_(curve->S1, curve->S1, curve->t0, curve->p); /* S1 = S1 * t0, (t0 has H^3) */
	bnCopy(R->y, curve->t2);
	bnSubMod_(R->y, curve->S1, curve->p); /* Y3 = t2 - S1 */

	/* Z3 = HZ1Z2, where Z1: P->z, Z2: Q->z, Z3: R->z */
	bnMulMod_(curve->t2, curve->H, P->z, curve->p); /* t2 = H * Z1 */
	bnMulMod_(R->z, curve->t2, Q->z, curve->p); /* Z3 = t2 * Z2 */

	if (P == R)
	FREE_EC_POINT(&tP);
	if (Q == R)
	FREE_EC_POINT(&tQ);
	return ret;
	}

	int ecMulPointScalar(const NistECpCurve curve, EcPoint R, const EcPoint P, const BigNum scalar)
	{

	/* MPI_CHK below macro requires a 'ret' variable and a cleanup label */
	int ret = 0;
	int i;
	int bits = bnBits(scalar);
	EcPoint n;

	INIT_EC_POINT(&n);
	bnCopy(n.x, P->x);
	bnCopy(n.y, P->y);
	bnCopy(n.z, P->z);

	bnSetQ(R->x, 0);
	bnSetQ(R->y, 0);
	bnSetQ(R->z, 0);

	for (i = 0; i < bits; i++) {
	if (bnReadBit(scalar, i))
	ecAddPoint(curve, R, R, &n);

	/* ecAddPoint(curve, &n, &n, &n); */
	ecDoublePoint(curve, &n, &n);
	}
	FREE_EC_POINT(&n);
	return ret;
	}

	#ifdef WEAKRANDOM
	/*
	* A standard random number generator that uses the portable random() system function.
	*
	* This should be enhanced to use a better random generator
	*/
	static int _random(unsigned char *output, size_t len)
	{
	size_t i;

	for(i = 0; i < len; ++i )
	output[i] = random();

	return( 0 );
	}
	#else
	#include <cryptcommon/ZrtpRandom.h>
	static int _random(unsigned char *output, size_t len)
	{
	return zrtp_getRandomData(output, len);
	}
	#endif

	int ecGenerateRandomNumber(const NistECpCurve curve, BigNum d)
	{
	BigNum c, nMinusOne;

	size_t randomBytes = ((bnBits(curve->n) + 64) + 7) / 8;

	uint8_t *ran = malloc(randomBytes);

	bnBegin(&c);
	bnBegin(&nMinusOne);

	bnCopy(&nMinusOne, curve->n);
	bnSubMod_(&nMinusOne, mpiOne, curve->p);

	bnSetQ(d, 0);

	while (!bnCmpQ(d, 0)) {
	/* use _random function */
	_random(ran, randomBytes);
	bnInsertBigBytes(&c, ran, 0, randomBytes);
	bnMod(d, &c, &nMinusOne);
	bnAddMod_(d, mpiOne, curve->p);
	}

	bnEnd(&c);
	bnEnd(&nMinusOne);
	free(ran);

	return 0;
	}