From 0f8a09a99caa716b4bbebf41c4d7f57866543584 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 10 Apr 2026 09:38:14 +0200 Subject: [PATCH] ecp: clarify static constants in grp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is not really necessary for 1.0+, but for the 3.6 branch where the structure and these constants are still public, it is cleaner. Signed-off-by: Manuel Pégourié-Gonnard --- include/mbedtls/ecp.h | 2 +- library/ecp.c | 6 +++++- library/ecp_curves.c | 29 +++++++++++++++-------------- 3 files changed, 21 insertions(+), 16 deletions(-) diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index f2905f05c6..af1c50484f 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -248,7 +248,7 @@ typedef struct mbedtls_ecp_group { private keys. */ /* End of public fields */ - unsigned int MBEDTLS_PRIVATE(h); /*!< \internal 1 if the constants are static. */ + unsigned int MBEDTLS_PRIVATE(h); /*!< \internal 1 if all the constants are static, 2 if only N and P are static */ int(*MBEDTLS_PRIVATE(modp))(mbedtls_mpi *); /*!< The function for fast pseudo-reduction mod \p P (see above).*/ int(*MBEDTLS_PRIVATE(t_pre))(mbedtls_ecp_point *, void *); /*!< Unused. */ diff --git a/library/ecp.c b/library/ecp.c index c87872fe07..a26219620d 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -582,7 +582,11 @@ void mbedtls_ecp_group_free(mbedtls_ecp_group *grp) mbedtls_mpi_free(&grp->A); mbedtls_mpi_free(&grp->B); mbedtls_ecp_point_free(&grp->G); - /* Don't free N and P, those are static */ + + if (grp->h != 2) { + mbedtls_mpi_free(&grp->N); + mbedtls_mpi_free(&grp->P); + } } if (!ecp_group_is_static_comb_table(grp) && grp->T != NULL) { diff --git a/library/ecp_curves.c b/library/ecp_curves.c index 55a28e3f99..e2cd7c648e 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -4542,7 +4542,7 @@ static int ecp_group_load(mbedtls_ecp_group *grp, grp->pbits = mbedtls_mpi_bitlen(&grp->P); grp->nbits = mbedtls_mpi_bitlen(&grp->N); - grp->h = 1; + grp->h = 1; /* All constants static */ grp->T = (mbedtls_ecp_point *) T; /* @@ -4663,14 +4663,17 @@ static int ecp_use_curve25519(mbedtls_ecp_group *grp) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - /* Actually ( A + 2 ) / 4 */ - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->A, curve25519_a24)); + /* Set this before anything that can fail and call ecp_group_free(). */ + grp->h = 2; /* N and P static, but not A, B or G */ ecp_mpi_load(&grp->P, curve25519_p, sizeof(curve25519_p)); - grp->pbits = mbedtls_mpi_bitlen(&grp->P); ecp_mpi_load(&grp->N, curve25519_n, sizeof(curve25519_n)); + grp->nbits = 254; /* Actually, the required msb for private keys */ + + /* Actually ( A + 2 ) / 4 */ + MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->A, curve25519_a24)); /* Y intentionally not set, since we use x/z coordinates. * This is used as a marker to identify Montgomery curves! */ @@ -4678,9 +4681,6 @@ static int ecp_use_curve25519(mbedtls_ecp_group *grp) MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->G.Z, 1)); mbedtls_mpi_free(&grp->G.Y); - /* Actually, the required msb for private keys */ - grp->nbits = 254; - cleanup: if (ret != 0) { mbedtls_ecp_group_free(grp); @@ -4725,23 +4725,24 @@ static int ecp_use_curve448(mbedtls_ecp_group *grp) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - /* Actually ( A + 2 ) / 4 */ - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->A, curve448_a24)); + /* Set this before anything that can fail and call ecp_group_free(). */ + grp->h = 2; /* N and P static, but not A, B or G */ ecp_mpi_load(&grp->P, curve448_p, sizeof(curve448_p)); grp->pbits = mbedtls_mpi_bitlen(&grp->P); + ecp_mpi_load(&grp->N, curve448_n, sizeof(curve448_n)); + grp->nbits = 447; /* Actually, the required msb for private keys */ + + /* Actually ( A + 2 ) / 4 */ + MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->A, curve448_a24)); + /* Y intentionally not set, since we use x/z coordinates. * This is used as a marker to identify Montgomery curves! */ MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->G.X, 5)); MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&grp->G.Z, 1)); mbedtls_mpi_free(&grp->G.Y); - ecp_mpi_load(&grp->N, curve448_n, sizeof(curve448_n)); - - /* Actually, the required msb for private keys */ - grp->nbits = 447; - cleanup: if (ret != 0) { mbedtls_ecp_group_free(grp);