Some EC_Group usage cleanups

This hides all symbols of CurveGFp and CurveGFp_Repr (which were
already marked as BOTAN_UNSTABLE_API and intentionally undocumented)
and makes them accessible only to a few specific friends.

For EC_Point deprecate a number of functions only needed for internal
use. Also add a couple of functions to simplify a future bridge
between our current APIs and pcurves.

In EC_Group likewise begin some cleanup and deprecation.

doc/api_ref/ecc.rst

@@ -39,6 +39,16 @@ during common operations.
           Initialize an elliptic curve group from the relevant parameters. This
           is used for example to create custom (application-specific) curves.
 
+          .. warning::
+
+             Currently a cofactor > 1 is accepted. In the future only prime order
+             subgroups will be allowed.
+
+          .. warning::
+
+             Currently primes of any size may be provided. In the
+             future the prime will be allowed to be at most 521 bits.
+
       .. cpp:function:: EC_Group(const std::vector<uint8_t>& ber_encoding)
 
          Initialize an ``EC_Group`` by decoding a DER encoded parameter block.
@@ -52,14 +62,6 @@ during common operations.
          Return the PEM encoding of this group (base64 of DER encoding plus
          header/trailer).
 
-      .. cpp:function:: bool a_is_minus_3() const
-
-         Return true if the ``a`` parameter is congruent to -3 mod p.
-
-      .. cpp:function:: bool a_is_zero() const
-
-         Return true if the ``a`` parameter is congruent to 0 mod p.
-
       .. cpp:function:: size_t get_p_bits() const
 
          Return size of the prime in bits.
@@ -108,6 +110,11 @@ during common operations.
 
          Return the cofactor of the curve. In most cases this will be 1.
 
+         .. warning::
+
+            In a future release all support for elliptic curves group with
+            a cofactor > 1 will be removed.
+
       .. cpp:function:: BigInt mod_order(const BigInt& x) const
 
          Reduce argument ``x`` modulo the curve order.
@@ -246,39 +253,3 @@ during common operations.
    .. cpp:function:: bool operator==(const EC_Point& other) const
 
       Point equality. This compares the affine representations.
-
-   .. cpp:function:: void add(const EC_Point& other, std::vector<BigInt>& workspace)
-
-      Point addition, taking a workspace.
-
-   .. cpp:function:: void add_affine(const EC_Point& other, std::vector<BigInt>& workspace)
-
-      Mixed (Jacobian+affine) addition, taking a workspace.
-
-      .. warning::
-
-         This function assumes that ``other`` is affine, if this is
-         not correct the result will be invalid.
-
-   .. cpp:function:: void mult2(std::vector<BigInt>& workspace)
-
-      Point doubling.
-
-   .. cpp:function:: void mult2i(size_t i, std::vector<BigInt>& workspace)
-
-      Repeated point doubling.
-
-   .. cpp:function:: EC_Point plus(const EC_Point& other, std::vector<BigInt>& workspace) const
-
-      Point addition, returning the result.
-
-   .. cpp:function:: EC_Point double_of(std::vector<BigInt>& workspace) const
-
-      Point doubling, returning the result.
-
-   .. cpp:function:: EC_Point zero() const
-
-      Return the point at infinity
-
-
-

doc/deprecated.rst

@@ -62,6 +62,11 @@ in a future major release.
   format is quite obscure and seemingly rarely implemented. Support
   for this encoding will be removed in a future release.
 
+- Currently `EC_Point` offers a wide variety of functionality almost
+  all of which was intended only for internal implementation. In a
+  future release, the only operations available for EC_Points will be
+  to extract the byte encoding of their affine x and y coordinates.
+
 - Currently it is possible to create an EC_Group with cofactor > 1.
   None of the builtin groups have composite order, and in the future
   it will be impossible to create composite order EC_Groups.

src/cli/pubkey.cpp

@@ -362,7 +362,7 @@ class EC_Group_Info final : public Command {
       }
 
       void go() override {
-         Botan::EC_Group ec_group(get_arg("name"));
+         const auto ec_group = Botan::EC_Group::from_name(get_arg("name"));
 
          if(flag_set("pem")) {
             output() << ec_group.PEM_encode();

src/cli/speed.cpp

@@ -712,8 +712,6 @@ class Speed final : public Command {
 #if defined(BOTAN_HAS_ECC_GROUP)
             else if(algo == "ecc_mult") {
                bench_ecc_mult(ecc_groups, msec);
-            } else if(algo == "ecc_ops") {
-               bench_ecc_ops(ecc_groups, msec);
             } else if(algo == "ecc_init") {
                bench_ecc_init(ecc_groups, msec);
             } else if(algo == "os2ecp") {
@@ -1074,42 +1072,13 @@ class Speed final : public Command {
       }
 
 #if defined(BOTAN_HAS_ECC_GROUP)
-      void bench_ecc_ops(const std::vector<std::string>& groups, const std::chrono::milliseconds runtime) {
-         for(const std::string& group_name : groups) {
-            const Botan::EC_Group ec_group(group_name);
-
-            auto add_timer = make_timer(group_name + " add");
-            auto addf_timer = make_timer(group_name + " addf");
-            auto dbl_timer = make_timer(group_name + " dbl");
-
-            const Botan::EC_Point& base_point = ec_group.get_base_point();
-
-            // create a non-affine point
-            const auto random_k = Botan::BigInt::from_u64(0x4E6F537465707E);
-            Botan::EC_Point non_affine_pt = ec_group.get_base_point() * random_k;
-            Botan::EC_Point pt = ec_group.get_base_point();
-
-            std::vector<Botan::BigInt> ws(Botan::EC_Point::WORKSPACE_SIZE);
-
-            while(add_timer->under(runtime) && addf_timer->under(runtime) && dbl_timer->under(runtime)) {
-               dbl_timer->run([&]() { pt.mult2(ws); });
-               add_timer->run([&]() { pt.add(non_affine_pt, ws); });
-               addf_timer->run([&]() { pt.add_affine(base_point, ws); });
-            }
-
-            record_result(dbl_timer);
-            record_result(add_timer);
-            record_result(addf_timer);
-         }
-      }
-
       void bench_ecc_init(const std::vector<std::string>& groups, const std::chrono::milliseconds runtime) {
          for(std::string group_name : groups) {
             auto timer = make_timer(group_name + " initialization");
 
             while(timer->under(runtime)) {
                Botan::EC_Group::clear_registered_curve_data();
-               timer->run([&]() { Botan::EC_Group group(group_name); });
+               timer->run([&]() { Botan::EC_Group::from_name(group_name); });
             }
 
             record_result(timer);
@@ -1118,7 +1087,7 @@ class Speed final : public Command {
 
       void bench_ecc_mult(const std::vector<std::string>& groups, const std::chrono::milliseconds runtime) {
          for(const std::string& group_name : groups) {
-            const Botan::EC_Group ec_group(group_name);
+            const auto ec_group = Botan::EC_Group::from_name(group_name);
 
             auto mult_timer = make_timer(group_name + " Montgomery ladder");
             auto blinded_mult_timer = make_timer(group_name + " blinded comb");
@@ -1155,7 +1124,7 @@ class Speed final : public Command {
             auto uncmp_timer = make_timer("OS2ECP uncompressed " + group_name);
             auto cmp_timer = make_timer("OS2ECP compressed " + group_name);
 
-            const Botan::EC_Group ec_group(group_name);
+            const auto ec_group = Botan::EC_Group::from_name(group_name);
 
             while(uncmp_timer->under(runtime) && cmp_timer->under(runtime)) {
                const Botan::BigInt k(rng(), 256);
@@ -1180,7 +1149,7 @@ class Speed final : public Command {
             auto h2c_ro_timer = make_timer(group_name + "-RO", "", "hash to curve");
             auto h2c_nu_timer = make_timer(group_name + "-NU", "", "hash to curve");
 
-            const Botan::EC_Group group(group_name);
+            const auto group = Botan::EC_Group::from_name(group_name);
 
             while(h2c_ro_timer->under(runtime)) {
                std::vector<uint8_t> input(32);
@@ -1793,7 +1762,7 @@ class Speed final : public Command {
                                 const std::string& /*unused*/,
                                 std::chrono::milliseconds msec) {
          for(const std::string& group_name : groups) {
-            Botan::EC_Group group(group_name);
+            const auto group = Botan::EC_Group::from_name(group_name);
             auto recovery_timer = make_timer("ECDSA recovery " + group_name);
 
             while(recovery_timer->under(msec)) {

src/cli/timing_tests.cpp

@@ -260,7 +260,9 @@ class ECDSA_Timing_Test final : public Timing_Test {
 };
 
 ECDSA_Timing_Test::ECDSA_Timing_Test(const std::string& ecgroup) :
-      m_group(ecgroup), m_privkey(timing_test_rng(), m_group), m_x(m_privkey.private_value()) {
+      m_group(Botan::EC_Group::from_name(ecgroup)),
+      m_privkey(timing_test_rng(), m_group),
+      m_x(m_privkey.private_value()) {
    m_b = m_group.random_scalar(timing_test_rng());
    m_b_inv = m_group.inverse_mod_order(m_b);
 }
@@ -296,7 +298,7 @@ ticks ECDSA_Timing_Test::measure_critical_function(const std::vector<uint8_t>& i
 
 class ECC_Mul_Timing_Test final : public Timing_Test {
    public:
-      explicit ECC_Mul_Timing_Test(const std::string& ecgroup) : m_group(ecgroup) {}
+      explicit ECC_Mul_Timing_Test(const std::string& ecgroup) : m_group(Botan::EC_Group::from_name(ecgroup)) {}
 
       ticks measure_critical_function(const std::vector<uint8_t>& input) override;
 

src/examples/ecdh.cpp

@@ -10,7 +10,7 @@ int main() {
    Botan::AutoSeeded_RNG rng;
 
    // ec domain and KDF
-   Botan::EC_Group domain("secp521r1");
+   const auto domain = Botan::EC_Group::from_name("secp521r1");
    const std::string kdf = "KDF2(SHA-256)";
 
    // the two parties generate ECDH keys

src/examples/ecdsa.cpp

@@ -9,7 +9,8 @@
 int main() {
    Botan::AutoSeeded_RNG rng;
    // Generate ECDSA keypair
-   Botan::ECDSA_PrivateKey key(rng, Botan::EC_Group("secp521r1"));
+   const auto group = Botan::EC_Group::from_name("secp521r1");
+   Botan::ECDSA_PrivateKey key(rng, group);
 
    const std::string message("This is a tasty burger!");
 

src/examples/pkcs11_ecdh.cpp

@@ -28,7 +28,7 @@ int main() {
    Botan::AutoSeeded_RNG rng;
 
    // create private key in software
-   Botan::ECDH_PrivateKey priv_key_sw(rng, Botan::EC_Group("secp256r1"));
+   Botan::ECDH_PrivateKey priv_key_sw(rng, Botan::EC_Group::from_name("secp256r1"));
    priv_key_sw.set_parameter_encoding(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID);
 
    // set import properties
@@ -81,13 +81,13 @@ int main() {
 
    Botan::PKCS11::PKCS11_ECDH_PrivateKey priv_key2(
       session,
-      Botan::EC_Group("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID),
+      Botan::EC_Group::from_name("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID),
       priv_generate_props);
 
    /************ generate ECDH key pair *************/
 
    Botan::PKCS11::EC_PublicKeyGenerationProperties pub_generate_props(
-      Botan::EC_Group("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID));
+      Botan::EC_Group::from_name("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID));
 
    pub_generate_props.set_label(label + "_PUB_KEY");
    pub_generate_props.set_token(true);

src/examples/pkcs11_ecdsa.cpp

@@ -27,7 +27,7 @@ int main() {
    // create private key in software
    Botan::AutoSeeded_RNG rng;
 
-   Botan::ECDSA_PrivateKey priv_key_sw(rng, Botan::EC_Group("secp256r1"));
+   Botan::ECDSA_PrivateKey priv_key_sw(rng, Botan::EC_Group::from_name("secp256r1"));
    priv_key_sw.set_parameter_encoding(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID);
 
    // set the private key import properties
@@ -78,13 +78,13 @@ int main() {
 
    Botan::PKCS11::PKCS11_ECDSA_PrivateKey pk(
       session,
-      Botan::EC_Group("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID),
+      Botan::EC_Group::from_name("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID),
       priv_generate_props);
 
    /************ generate PKCS#11 ECDSA key pair *************/
 
    Botan::PKCS11::EC_PublicKeyGenerationProperties pub_generate_props(
-      Botan::EC_Group("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID));
+      Botan::EC_Group::from_name("secp256r1").DER_encode(Botan::EC_Group_Encoding::EC_DOMPAR_ENC_OID));
 
    pub_generate_props.set_label("BOTAN_TEST_ECDSA_PUB_KEY");
    pub_generate_props.set_token(true);

src/examples/tls_custom_curves_client.cpp

@@ -1,3 +1,5 @@
+#define BOTAN_NO_DEPRECATED_WARNINGS
+
 #include <botan/auto_rng.h>
 #include <botan/certstor.h>
 #include <botan/ecdh.h>
@@ -34,7 +36,7 @@ class Callbacks : public Botan::TLS::Callbacks {
          if(std::holds_alternative<Botan::TLS::Group_Params>(group) &&
             std::get<Botan::TLS::Group_Params>(group) == Botan::TLS::Group_Params(0xFE00)) {
             // generate a private key of my custom curve
-            const Botan::EC_Group ec_group("testcurve1102");
+            const auto ec_group = Botan::EC_Group::from_name("testcurve1102");
             return std::make_unique<Botan::ECDH_PrivateKey>(rng, ec_group);
          } else {
             // no custom curve used: up-call the default implementation
@@ -51,7 +53,7 @@ class Callbacks : public Botan::TLS::Callbacks {
          if(std::holds_alternative<Botan::TLS::Group_Params>(group) &&
             std::get<Botan::TLS::Group_Params>(group) == Botan::TLS::Group_Params(0xFE00)) {
             // perform a key agreement on my custom curve
-            const Botan::EC_Group ec_group("testcurve1102");
+            const auto ec_group = Botan::EC_Group::from_name("testcurve1102");
             Botan::ECDH_PublicKey peer_key(ec_group, ec_group.OS2ECP(public_value));
             Botan::PK_Key_Agreement ka(private_key, rng, "Raw");
             return ka.derive_key(0, peer_key.public_value()).bits_of();

src/lib/ffi/ffi_pkey_algs.cpp

@@ -88,7 +88,7 @@ int privkey_load_ec(std::unique_ptr<ECPrivateKey_t>& key, const Botan::BigInt& s
    }
 
    Botan::Null_RNG null_rng;
-   Botan::EC_Group grp(curve_name);
+   const auto grp = Botan::EC_Group::from_name(curve_name);
    key.reset(new ECPrivateKey_t(null_rng, grp, scalar));
    return BOTAN_FFI_SUCCESS;
 }
@@ -102,7 +102,7 @@ int pubkey_load_ec(std::unique_ptr<ECPublicKey_t>& key,
       return BOTAN_FFI_ERROR_NULL_POINTER;
    }
 
-   Botan::EC_Group grp(curve_name);
+   const auto grp = Botan::EC_Group::from_name(curve_name);
    Botan::EC_Point uncompressed_point = grp.point(public_x, public_y);
    key.reset(new ECPublicKey_t(grp, uncompressed_point));
    return BOTAN_FFI_SUCCESS;

src/lib/prov/pkcs11/p11_ecc_key.cpp

@@ -102,7 +102,7 @@ PKCS11_EC_PrivateKey::PKCS11_EC_PrivateKey(Session& session,
 }
 
 size_t PKCS11_EC_PrivateKey::key_length() const {
-   return m_domain_params.get_order().bits();
+   return m_domain_params.get_order_bits();
 }
 
 std::vector<uint8_t> PKCS11_EC_PrivateKey::public_key_bits() const {

src/lib/prov/pkcs11/p11_ecdsa.cpp

@@ -56,7 +56,7 @@ class PKCS11_ECDSA_Signature_Operation final : public PK_Ops::Signature {
       PKCS11_ECDSA_Signature_Operation(const PKCS11_ECDSA_PrivateKey& key, std::string_view hash) :
             PK_Ops::Signature(),
             m_key(key),
-            m_order(key.domain().get_order()),
+            m_order_bytes(key.domain().get_order_bytes()),
             m_mechanism(MechanismWrapper::create_ecdsa_mechanism(hash)),
             m_hash(hash) {}
 
@@ -92,15 +92,15 @@ class PKCS11_ECDSA_Signature_Operation final : public PK_Ops::Signature {
          return signature;
       }
 
-      size_t signature_length() const override { return 2 * m_order.bytes(); }
+      size_t signature_length() const override { return 2 * m_order_bytes; }
 
       AlgorithmIdentifier algorithm_identifier() const override;
 
       std::string hash_function() const override { return m_hash; }
 
    private:
       const PKCS11_ECDSA_PrivateKey m_key;
-      const BigInt m_order;
+      const size_t m_order_bytes;
       MechanismWrapper m_mechanism;
       const std::string m_hash;
       secure_vector<uint8_t> m_first_message;
@@ -118,7 +118,6 @@ class PKCS11_ECDSA_Verification_Operation final : public PK_Ops::Verification {
       PKCS11_ECDSA_Verification_Operation(const PKCS11_ECDSA_PublicKey& key, std::string_view hash) :
             PK_Ops::Verification(),
             m_key(key),
-            m_order(key.domain().get_order()),
             m_mechanism(MechanismWrapper::create_ecdsa_mechanism(hash)),
             m_hash(hash) {}
 
@@ -166,7 +165,6 @@ class PKCS11_ECDSA_Verification_Operation final : public PK_Ops::Verification {
 
    private:
       const PKCS11_ECDSA_PublicKey m_key;
-      const BigInt m_order;
       MechanismWrapper m_mechanism;
       const std::string m_hash;
       secure_vector<uint8_t> m_first_message;

src/lib/prov/pkcs11/p11_ecdsa.h

@@ -107,7 +107,7 @@ class BOTAN_PUBLIC_API(2, 0) PKCS11_ECDSA_PrivateKey final : public PKCS11_EC_Pr
 
       size_t message_parts() const override { return 2; }
 
-      size_t message_part_size() const override { return domain().get_order().bytes(); }
+      size_t message_part_size() const override { return domain().get_order_bytes(); }
 
       /// @return the exported ECDSA private key
       ECDSA_PrivateKey export_key() const;