ECPoint.java

packageopencrypto.jcmathlib;

importjavacard.framework.ISOException;
importjavacard.framework.Util;
importjavacard.security.*;

/**
 * @author Vasilios Mavroudis and Petr Svenda and Antonin Dufka
 */
publicclassECPoint {
privatefinalResourceManagerrm;

privateECPublicKeypoint;
privateKeyPairpointKeyPair;
privatefinalECCurvecurve;

/**
 * Creates new ECPoint object for provided {@code curve}. Random initial point value is generated.
 *
 * @param curve point's elliptic curve
 */
publicECPoint(ECCurvecurve) {
this.curve = curve;
this.rm = curve.rm;
updatePointObjects();
 }

/**
 * Returns length of this point in bytes.
 *
 * @return length of this point in bytes
 */
publicshortlength() {
return (short) (point.getSize() / 8);
 }

/**
 * Properly updates all point values in case of a change of an underlying curve.
 * New random point value is generated.
 */
publicfinalvoidupdatePointObjects() {
pointKeyPair = curve.newKeyPair(pointKeyPair);
point = (ECPublicKey) pointKeyPair.getPublic();
 }

/**
 * Generates new random point value.
 */
publicvoidrandomize() {
if (OperationSupport.getInstance().EC_GEN) {
pointKeyPair.genKeyPair(); // Fails for some curves on some cards
 } else {
BigNattmp = rm.EC_BN_A;
rm.lock(rm.ARRAY_A);
rm.rng.generateData(rm.ARRAY_A, (short) 0, (short) (curve.KEY_BIT_LENGTH / 8 + 16));
tmp.lock();
tmp.fromByteArray(rm.ARRAY_A, (short) 0, (short) (curve.KEY_BIT_LENGTH / 8 + 16));
tmp.mod(curve.rBN);
tmp.shrink();
rm.unlock(rm.ARRAY_A);
point.setW(curve.G, (short) 0, (short) curve.G.length);
multiplication(tmp);
tmp.unlock();
 }
 }

/**
 * Copy value of provided point into this. This and other point must have
 * curve with same parameters, only length is checked.
 *
 * @param other point to be copied
 */
publicvoidcopy(ECPointother) {
if (length() != other.length()) {
ISOException.throwIt(ReturnCodes.SW_ECPOINT_INVALIDLENGTH);
 }
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
shortlen = other.getW(pointBuffer, (short) 0);
setW(pointBuffer, (short) 0, len);
rm.unlock(pointBuffer);
 }

/**
 * Set this point value (parameter W) from array with value encoded as per ANSI X9.62.
 * The uncompressed form is always supported. If underlying native JavaCard implementation
 * of {@code ECPublicKey} supports compressed points, then this method accepts also compressed points.
 *
 * @param buffer array with serialized point
 * @param offset start offset within input array
 * @param length length of point
 */
publicvoidsetW(byte[] buffer, shortoffset, shortlength) {
point.setW(buffer, offset, length);
 }

/**
 * Returns current value of this point.
 *
 * @param buffer memory array where to store serailized point value
 * @param offset start offset for output serialized point
 * @return length of serialized point (number of bytes)
 */
publicshortgetW(byte[] buffer, shortoffset) {
returnpoint.getW(buffer, offset);
 }

/**
 * Returns this point value as ECPublicKey object. No copy of point is made
 * before return, so change of returned object will also change this point value.
 *
 * @return point as ECPublicKey object
 */
publicECPublicKeyasPublicKey() {
returnpoint;
 }

/**
 * Returns curve associated with this point. No copy of curve is made
 * before return, so change of returned object will also change curve for
 * this point.
 *
 * @return curve as ECCurve object
 */
publicECCurvegetCurve() {
returncurve;
 }

/**
 * Returns the X coordinate of this point in uncompressed form.
 *
 * @param buffer output array for X coordinate
 * @param offset start offset within output array
 * @return length of X coordinate (in bytes)
 */
publicshortgetX(byte[] buffer, shortoffset) {
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
point.getW(pointBuffer, (short) 0);
Util.arrayCopyNonAtomic(pointBuffer, (short) 1, buffer, offset, curve.COORD_SIZE);
rm.unlock(pointBuffer);
returncurve.COORD_SIZE;
 }

/**
 * Returns the Y coordinate of this point in uncompressed form.
 *
 * @param buffer output array for Y coordinate
 * @param offset start offset within output array
 * @return length of Y coordinate (in bytes)
 */
publicshortgetY(byte[] buffer, shortoffset) {
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
point.getW(pointBuffer, (short) 0);
Util.arrayCopyNonAtomic(pointBuffer, (short) (1 + curve.COORD_SIZE), buffer, offset, curve.COORD_SIZE);
rm.unlock(pointBuffer);
returncurve.COORD_SIZE;
 }

/**
 * Double this point. Pure implementation without KeyAgreement.
 */
publicvoidswDouble() {
byte[] pointBuffer = rm.POINT_ARRAY_A;
BigNatpX = rm.EC_BN_B;
BigNatpY = rm.EC_BN_C;
BigNatlambda = rm.EC_BN_D;
BigNattmp = rm.EC_BN_E;

rm.lock(pointBuffer);
getW(pointBuffer, (short) 0);

pX.lock();
pX.fromByteArray(pointBuffer, (short) 1, curve.COORD_SIZE);

pY.lock();
pY.fromByteArray(pointBuffer, (short) (1 + curve.COORD_SIZE), curve.COORD_SIZE);

lambda.lock();
lambda.clone(pX);
lambda.modSq(curve.pBN);
lambda.modMult(ResourceManager.THREE, curve.pBN);
lambda.modAdd(curve.aBN, curve.pBN);

tmp.lock();
tmp.clone(pY);
tmp.modAdd(tmp, curve.pBN);
tmp.modInv(curve.pBN);
lambda.modMult(tmp, curve.pBN);
tmp.clone(lambda);
tmp.modSq(curve.pBN);
tmp.modSub(pX, curve.pBN);
tmp.modSub(pX, curve.pBN);
tmp.prependZeros(curve.COORD_SIZE, pointBuffer, (short) 1);

tmp.modSub(pX, curve.pBN);
pX.unlock();
tmp.modMult(lambda, curve.pBN);
lambda.unlock();
tmp.modAdd(pY, curve.pBN);
tmp.modNegate(curve.pBN);
pY.unlock();
tmp.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (1 + curve.COORD_SIZE));
tmp.unlock();

setW(pointBuffer, (short) 0, curve.POINT_SIZE);
rm.unlock(pointBuffer);
 }


/**
 * Doubles the current value of this point.
 */
publicvoidmakeDouble() {
// doubling via add sometimes causes exception inside KeyAgreement engine
// this.add(this);
// Use bit slower, but more robust version via multiplication by 2
this.multiplication(ResourceManager.TWO);
 }

/**
 * Adds this (P) and provided (Q) point. Stores a resulting value into this point.
 *
 * @param other point to be added to this.
 */
publicvoidadd(ECPointother) {
if (OperationSupport.getInstance().EC_HW_ADD) {
hwAdd(other);
 } else {
swAdd(other);
 }
 }

/**
 * Implements adding of two points without ALG_EC_PACE_GM.
 *
 * @param other point to be added to this.
 */
privatevoidswAdd(ECPointother) {
booleansamePoint = this == other || isEqual(other);
if (samePoint && OperationSupport.getInstance().EC_HW_XY) {
multiplication(ResourceManager.TWO);
return;
 }

byte[] pointBuffer = rm.POINT_ARRAY_A;
BigNatxR = rm.EC_BN_B;
BigNatyR = rm.EC_BN_C;
BigNatxP = rm.EC_BN_D;
BigNatyP = rm.EC_BN_E;
BigNatxQ = rm.EC_BN_F;
BigNatnominator = rm.EC_BN_B;
BigNatdenominator = rm.EC_BN_C;
BigNatlambda = rm.EC_BN_A;

rm.lock(pointBuffer);
point.getW(pointBuffer, (short) 0);
xP.lock();
xP.setSize(curve.COORD_SIZE);
xP.fromByteArray(pointBuffer, (short) 1, curve.COORD_SIZE);
yP.lock();
yP.setSize(curve.COORD_SIZE);
yP.fromByteArray(pointBuffer, (short) (1 + curve.COORD_SIZE), curve.COORD_SIZE);
rm.unlock(pointBuffer);


// l = (y_q-y_p)/(x_q-x_p))
// x_r = l^2 - x_p -x_q
// y_r = l(x_p-x_r)-y_p

// P + Q = R
nominator.lock();
denominator.lock();
if (samePoint) {
// lambda = (3(x_p^2)+a)/(2y_p)
// (3(x_p^2)+a)
nominator.clone(xP);
nominator.modSq(curve.pBN);
nominator.modMult(ResourceManager.THREE, curve.pBN);
nominator.modAdd(curve.aBN, curve.pBN);
// (2y_p)
denominator.clone(yP);
denominator.modMult(ResourceManager.TWO, curve.pBN);
denominator.modInv(curve.pBN);

 } else {
// lambda = (y_q-y_p) / (x_q-x_p) mod p
rm.lock(pointBuffer);
other.point.getW(pointBuffer, (short) 0);
xQ.lock();
xQ.setSize(curve.COORD_SIZE);
xQ.fromByteArray(pointBuffer, (short) 1, other.curve.COORD_SIZE);
nominator.setSize(curve.COORD_SIZE);
nominator.fromByteArray(pointBuffer, (short) (1 + curve.COORD_SIZE), curve.COORD_SIZE);
rm.unlock(pointBuffer);

nominator.mod(curve.pBN);

nominator.modSub(yP, curve.pBN);

// (x_q-x_p)
denominator.clone(xQ);
denominator.mod(curve.pBN);
denominator.modSub(xP, curve.pBN);
denominator.modInv(curve.pBN);
 }

lambda.lock();
lambda.clone(nominator);
lambda.modMult(denominator, curve.pBN);
nominator.unlock();
denominator.unlock();

// (x_p, y_p) + (x_q, y_q) = (x_r, y_r)
// lambda = (y_q - y_p) / (x_q - x_p)

// x_r = lambda^2 - x_p - x_q
xR.lock();
if (samePoint) {
rm.lock(pointBuffer);
shortlen = multXKA(ResourceManager.TWO, pointBuffer, (short) 0);
xR.fromByteArray(pointBuffer, (short) 0, len);
rm.unlock(pointBuffer);
 } else {
xR.clone(lambda);
xR.modSq(curve.pBN);
xR.modSub(xP, curve.pBN);
xR.modSub(xQ, curve.pBN);
 }
xQ.unlock();

// y_r = lambda(x_p - x_r) - y_p
yR.lock();
yR.clone(xP);
xP.unlock();
yR.modSub(xR, curve.pBN);
yR.modMult(lambda, curve.pBN);
lambda.unlock();
yR.modSub(yP, curve.pBN);
yP.unlock();

rm.lock(pointBuffer);
pointBuffer[0] = (byte) 0x04;
// If x_r.length() and y_r.length() is smaller than curve.COORD_SIZE due to leading zeroes which were shrunk before, then we must add these back
xR.prependZeros(curve.COORD_SIZE, pointBuffer, (short) 1);
xR.unlock();
yR.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (1 + curve.COORD_SIZE));
yR.unlock();
setW(pointBuffer, (short) 0, curve.POINT_SIZE);
rm.unlock(pointBuffer);
 }

/**
 * Implements adding of two points via ALG_EC_PACE_GM.
 *
 * @param other point to be added to this.
 */
privatevoidhwAdd(ECPointother) {
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
setW(pointBuffer, (short) 0, multAndAddKA(ResourceManager.ONE_COORD, other, pointBuffer, (short) 0));
rm.unlock(pointBuffer);
 }

/**
 * Multiply value of this point by provided scalar. Stores the result into this point.
 *
 * @param scalarBytes value of scalar for multiplication
 */
publicvoidmultiplication(byte[] scalarBytes, shortscalarOffset, shortscalarLen) {
BigNatscalar = rm.EC_BN_F;

scalar.lock();
scalar.setSize(scalarLen);
scalar.fromByteArray(scalarBytes, scalarOffset, scalarLen);
multiplication(scalar);
scalar.unlock();
 }

/**
 * Multiply value of this point by provided scalar. Stores the result into this point.
 *
 * @param scalar value of scalar for multiplication
 */
publicvoidmultiplication(BigNatscalar) {
if (OperationSupport.getInstance().EC_SW_DOUBLE && scalar.equals(ResourceManager.TWO)) {
swDouble();
// } else if (rm.ecMultKA.getAlgorithm() == KeyAgreement.ALG_EC_SVDP_DH_PLAIN_XY) {
 } elseif (rm.ecMultKA.getAlgorithm() == (byte) 6) {
multXY(scalar);
//} else if (rm.ecMultKA.getAlgorithm() == KeyAgreement.ALG_EC_SVDP_DH_PLAIN) {
 } elseif (rm.ecMultKA.getAlgorithm() == (byte) 3) {
multX(scalar);
 } else {
ISOException.throwIt(ReturnCodes.SW_OPERATION_NOT_SUPPORTED);
 }
 }

/**
 * Multiply this point by a given scalar and add another point to the result.
 *
 * @param scalar value of scalar for multiplication
 * @param point the other point
 */
publicvoidmultAndAdd(BigNatscalar, ECPointpoint) {
if (OperationSupport.getInstance().EC_HW_ADD) {
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
setW(pointBuffer, (short) 0, multAndAddKA(scalar, point, pointBuffer, (short) 0));
rm.unlock(pointBuffer);
 } else {
multiplication(scalar);
add(point);
 }
 }

/**
 * Multiply this point by a given scalar and add another point to the result and store the result into outBuffer.
 *
 * @param scalar value of scalar for multiplication
 * @param point the other point
 * @param outBuffer output buffer
 * @param outBufferOffset offset in the output buffer
 */
privateshortmultAndAddKA(BigNatscalar, ECPointpoint, byte[] outBuffer, shortoutBufferOffset) {
byte[] pointBuffer = rm.POINT_ARRAY_B;

rm.lock(pointBuffer);
shortlen = getW(pointBuffer, (short) 0);
curve.disposablePriv.setG(pointBuffer, (short) 0, len);
scalar.prependZeros((short) curve.r.length, pointBuffer, (short) 0);
curve.disposablePriv.setS(pointBuffer, (short) 0, (short) curve.r.length);
rm.ecAddKA.init(curve.disposablePriv);

len = point.getW(pointBuffer, (short) 0);
len = rm.ecAddKA.generateSecret(pointBuffer, (short) 0, len, outBuffer, outBufferOffset);
rm.unlock(pointBuffer);
returnlen;
 }

/**
 * Multiply value of this point by provided scalar using XY key agreement. Stores the result into this point.
 *
 * @param scalar value of scalar for multiplication
 */
publicvoidmultXY(BigNatscalar) {
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
shortlen = multXYKA(scalar, pointBuffer, (short) 0);
setW(pointBuffer, (short) 0, len);
rm.unlock(pointBuffer);
 }

/**
 * Multiplies this point value with provided scalar and stores result into
 * provided array. No modification of this point is performed.
 * Native XY KeyAgreement engine is used.
 *
 * @param scalar value of scalar for multiplication
 * @param outBuffer output array for resulting value
 * @param outBufferOffset offset within output array
 * @return length of resulting value (in bytes)
 */
publicshortmultXYKA(BigNatscalar, byte[] outBuffer, shortoutBufferOffset) {
byte[] pointBuffer = rm.POINT_ARRAY_B;

rm.lock(pointBuffer);
scalar.prependZeros((short) curve.r.length, pointBuffer, (short) 0);
curve.disposablePriv.setS(pointBuffer, (short) 0, (short) curve.r.length);
rm.ecMultKA.init(curve.disposablePriv);

shortlen = getW(pointBuffer, (short) 0);
len = rm.ecMultKA.generateSecret(pointBuffer, (short) 0, len, outBuffer, outBufferOffset);
rm.unlock(pointBuffer);
returnlen;
 }

/**
 * Multiply value of this point by provided scalar using X-only key agreement. Stores the result into this point.
 *
 * @param scalar value of scalar for multiplication
 */
privatevoidmultX(BigNatscalar) {
byte[] pointBuffer = rm.POINT_ARRAY_A;
byte[] pointBuffer2 = rm.POINT_ARRAY_B;
byte[] resultBuffer = rm.ARRAY_A;
BigNatx = rm.EC_BN_B;
BigNatySq = rm.EC_BN_C;
BigNaty = rm.EC_BN_D;
BigNatlambda = rm.EC_BN_E;
BigNattmp = rm.EC_BN_F;
BigNatdenominator = rm.EC_BN_D;

rm.lock(pointBuffer);
shortlen = multXKA(scalar, pointBuffer, (short) 0);
x.lock();
x.fromByteArray(pointBuffer, (short) 0, len);
rm.unlock(pointBuffer);

// Solve for Y in Weierstrass equation: Y^2 = X^3 + XA + B = x(x^2+A)+B
ySq.lock();
ySq.clone(x);
ySq.modExp(ResourceManager.TWO, curve.pBN);
ySq.modAdd(curve.aBN, curve.pBN);
ySq.modMult(x, curve.pBN);
ySq.modAdd(curve.bBN, curve.pBN);
y.lock();
y.clone(ySq);
ySq.unlock();
y.modSqrt(curve.pBN);

// Construct public key with <x, y>
rm.lock(pointBuffer);
pointBuffer[0] = 0x04;
x.prependZeros(curve.COORD_SIZE, pointBuffer, (short) 1);
x.unlock();
y.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (1 + curve.COORD_SIZE));
y.unlock();

booleannegate;
if (OperationSupport.getInstance().EC_HW_X_ECDSA) {
rm.lock(pointBuffer2);
getW(pointBuffer2, (short) 0);
curve.disposablePriv.setG(pointBuffer2, (short) 0, curve.POINT_SIZE);
curve.disposablePub.setG(pointBuffer2, (short) 0, curve.POINT_SIZE);
rm.unlock(pointBuffer2);

setW(pointBuffer, (short) 0, curve.POINT_SIZE);

// Check if <x, y> corresponds to the "secret" (i.e., our scalar)
rm.lock(resultBuffer);
scalar.prependZeros((short) curve.r.length, resultBuffer, (short) 0);
curve.disposablePriv.setS(resultBuffer, (short) 0, (short) curve.r.length);
curve.disposablePub.setW(pointBuffer, (short) 0, curve.POINT_SIZE);
negate = !SignVerifyECDSA(curve.disposablePriv, curve.disposablePub, rm.verifyEcdsa, resultBuffer);
rm.unlock(resultBuffer);
 } else {
// Check that (<x, y> + P)_x == ((scalar + 1)P)_x
x.lock();
rm.lock(resultBuffer);
scalar.increment();
len = multXKA(scalar, resultBuffer, (short) 0);
x.fromByteArray(resultBuffer, (short) 0, len);
rm.unlock(resultBuffer);
scalar.decrement(); // keep the original

rm.lock(pointBuffer2);
getW(pointBuffer2, (short) 0);
setW(pointBuffer, (short) 0, curve.POINT_SIZE);

// y_1 - y_2
lambda.lock();
lambda.fromByteArray(pointBuffer2, (short) (1 + curve.COORD_SIZE), curve.COORD_SIZE);
tmp.lock();
tmp.fromByteArray(pointBuffer, (short) (1 + curve.COORD_SIZE), curve.COORD_SIZE);
lambda.modSub(tmp, curve.pBN);

// (x_1 - x_2)^-1
denominator.lock();
denominator.fromByteArray(pointBuffer2, (short) 1, curve.COORD_SIZE);
tmp.fromByteArray(pointBuffer, (short) 1, curve.COORD_SIZE);
denominator.modSub(tmp, curve.pBN);
denominator.modInv(curve.pBN);

// λ = (y_1 - y_2)/(x_1 - x_2)
lambda.modMult(denominator, curve.pBN);
denominator.unlock();

// x_3 = λ^2 - x_1 - x_2
lambda.modSq(curve.pBN);
tmp.fromByteArray(pointBuffer2, (short) 1, curve.COORD_SIZE);
lambda.modSub(tmp, curve.pBN);
tmp.fromByteArray(pointBuffer, (short) 1, curve.COORD_SIZE);
lambda.modSub(tmp, curve.pBN);
tmp.unlock();

// If <x, y> + P != (scalar + 1)P, negate the point
negate = !lambda.equals(x);
lambda.unlock();
x.unlock();
 }
rm.unlock(pointBuffer);
if (negate)
negate();
 }

/**
 * Multiplies this point value with provided scalar and stores result into
 * provided array. No modification of this point is performed.
 * Native X-only KeyAgreement engine is used.
 *
 * @param scalar value of scalar for multiplication
 * @param outBuffer output array for resulting value
 * @param outBufferOffset offset within output array
 * @return length of resulting value (in bytes)
 */
privateshortmultXKA(BigNatscalar, byte[] outBuffer, shortoutBufferOffset) {
byte[] pointBuffer = rm.POINT_ARRAY_B;
// NOTE: potential problem on real cards (j2e) - when small scalar is used (e.g., BigNat.TWO), operation sometimes freezes
rm.lock(pointBuffer);
scalar.prependZeros((short) curve.r.length, pointBuffer, (short) 0);
curve.disposablePriv.setS(pointBuffer, (short) 0, (short) curve.r.length);

rm.ecMultKA.init(curve.disposablePriv);

shortlen = getW(pointBuffer, (short) 0);
rm.ecMultKA.generateSecret(pointBuffer, (short) 0, len, outBuffer, outBufferOffset);
rm.unlock(pointBuffer);
// Return always length of whole coordinate X instead of len - some real cards returns shorter value equal to SHA-1 output size although PLAIN results is filled into buffer (GD60) 
returncurve.COORD_SIZE;
 }

/**
 * Computes negation of this point.
 * The operation will dump point into uncompressed_point_arr, negate Y and restore back
 */
publicvoidnegate() {
byte[] pointBuffer = rm.POINT_ARRAY_A;
BigNaty = rm.EC_BN_C;

y.lock();
rm.lock(pointBuffer);
point.getW(pointBuffer, (short) 0);
y.setSize(curve.COORD_SIZE);
y.fromByteArray(pointBuffer, (short) (1 + curve.COORD_SIZE), curve.COORD_SIZE);
y.modNegate(curve.pBN);
y.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (1 + curve.COORD_SIZE));
y.unlock();
setW(pointBuffer, (short) 0, curve.POINT_SIZE);
rm.unlock(pointBuffer);
 }

/**
 * Restore point from X coordinate. Stores one of the two results into this point.
 *
 * @param xCoord byte array containing the X coordinate
 * @param xOffset offset in the byte array
 * @param xLen length of the X coordinate
 */
publicbooleanfromX(byte[] xCoord, shortxOffset, shortxLen) {
BigNatx = rm.EC_BN_F;

x.lock();
x.setSize(xLen);
x.fromByteArray(xCoord, xOffset, xLen);
booleanresult = fromX(x);
x.unlock();
returnresult;
 }

/**
 * Restore point from X coordinate. Stores one of the two results into this point.
 *
 * @param x the x coordinate
 */
privatebooleanfromX(BigNatx) {
BigNatySq = rm.EC_BN_C;
BigNaty = rm.EC_BN_D;
byte[] pointBuffer = rm.POINT_ARRAY_A;

//Y^2 = X^3 + XA + B = x(x^2+A)+B
ySq.lock();
ySq.clone(x);
ySq.modSq(curve.pBN);
ySq.modAdd(curve.aBN, curve.pBN);
ySq.modMult(x, curve.pBN);
ySq.modAdd(curve.bBN, curve.pBN);
y.lock();
y.clone(ySq);
if (!y.isQuadraticResidue(curve.pBN)) {
returnfalse;
 }
ySq.unlock();
y.modSqrt(curve.pBN);

// Construct public key with <x, y_1>
rm.lock(pointBuffer);
pointBuffer[0] = 0x04;
x.prependZeros(curve.COORD_SIZE, pointBuffer, (short) 1);
y.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (1 + curve.COORD_SIZE));
y.unlock();
setW(pointBuffer, (short) 0, curve.POINT_SIZE);
rm.unlock(pointBuffer);
returntrue;
 }

/**
 * Returns true if Y coordinate is even; false otherwise.
 *
 * @return true if Y coordinate is even; false otherwise
 */
publicbooleanisYEven() {
byte[] pointBuffer = rm.POINT_ARRAY_A;

rm.lock(pointBuffer);
point.getW(pointBuffer, (short) 0);
booleanresult = pointBuffer[(short) (curve.POINT_SIZE - 1)] % 2 == 0;
rm.unlock(pointBuffer);
returnresult;
 }

/**
 * Compares this and provided point for equality. The comparison is made using hash of both values to prevent leak of position of mismatching byte.
 *
 * @param other second point for comparison
 * @return true if both point are exactly equal (same length, same value), false otherwise
 */
publicbooleanisEqual(ECPointother) {
if (length() != other.length()) {
returnfalse;
 }
// The comparison is made with hash of point values instead of directly values.
// This way, offset of first mismatching byte is not leaked via timing side-channel.
// Additionally, only single array is required for storage of plain point values thus saving some RAM.
byte[] pointBuffer = rm.POINT_ARRAY_A;
byte[] hashBuffer = rm.HASH_ARRAY;

rm.lock(pointBuffer);
rm.lock(hashBuffer);
shortlen = getW(pointBuffer, (short) 0);
rm.hashEngine.doFinal(pointBuffer, (short) 0, len, hashBuffer, (short) 0);
len = other.getW(pointBuffer, (short) 0);
len = rm.hashEngine.doFinal(pointBuffer, (short) 0, len, pointBuffer, (short) 0);
booleanbResult = Util.arrayCompare(hashBuffer, (short) 0, pointBuffer, (short) 0, len) == 0;
rm.unlock(hashBuffer);
rm.unlock(pointBuffer);

returnbResult;
 }

staticbyte[] msg = {(byte) 0x01, (byte) 0x01, (byte) 0x02, (byte) 0x03};

publicstaticbooleanSignVerifyECDSA(ECPrivateKeyprivateKey, ECPublicKeypublicKey, SignaturesignEngine, byte[] tmpSignArray) {
signEngine.init(privateKey, Signature.MODE_SIGN);
shortsignLen = signEngine.sign(msg, (short) 0, (short) msg.length, tmpSignArray, (short) 0);
signEngine.init(publicKey, Signature.MODE_VERIFY);
returnsignEngine.verify(msg, (short) 0, (short) msg.length, tmpSignArray, (short) 0, signLen);
 }


/**
 * Decode SEC1-encoded point and load it into this.
 *
 * @param point array containing SEC1-encoded point
 * @param offset offset within the output buffer
 * @param length length of the encoded point
 * @return true if the point was compressed; false otherwise
 */
publicbooleandecode(byte[] point, shortoffset, shortlength) {
if(length == (short) (1 + 2 * curve.COORD_SIZE) && point[offset] == 0x04) {
setW(point, offset, length);
returnfalse;
 }
if (length == (short) (1 + curve.COORD_SIZE)) {
BigNaty = rm.EC_BN_C;
BigNatx = rm.EC_BN_D;
BigNatp = rm.EC_BN_E;
byte[] pointBuffer = rm.POINT_ARRAY_A;

x.lock();
x.fromByteArray(point, (short) (offset + 1), curve.COORD_SIZE);

//Y^2 = X^3 + XA + B = x(x^2+A)+B
y.lock();
y.clone(x);
y.modSq(curve.pBN);
y.modAdd(curve.aBN, curve.pBN);
y.modMult(x, curve.pBN);
y.modAdd(curve.bBN, curve.pBN);
y.modSqrt(curve.pBN);

rm.lock(pointBuffer);
pointBuffer[0] = 0x04;
x.prependZeros(curve.COORD_SIZE, pointBuffer, (short) 1);
x.unlock();

p.lock();
booleanodd = y.isOdd();
if ((!odd && point[offset] != (byte) 0x02) || (odd && point[offset] != (byte) 0x03)) {
p.clone(curve.pBN);
p.subtract(y);
p.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (curve.COORD_SIZE + 1));
 } else {
y.prependZeros(curve.COORD_SIZE, pointBuffer, (short) (curve.COORD_SIZE + 1));
 }
y.unlock();
p.unlock();
setW(pointBuffer, (short) 0, curve.POINT_SIZE);
rm.unlock(pointBuffer);
returntrue;
 }
ISOException.throwIt(ReturnCodes.SW_ECPOINT_INVALID);
returntrue; // unreachable
 }

/**
 * Encode this point into the output buffer.
 *
 * @param output output buffer; MUST be able to store offset + uncompressed size bytes
 * @param offset offset within the output buffer
 * @param compressed output compressed point if true; uncompressed otherwise
 * @return length of output point
 */
publicshortencode(byte[] output, shortoffset, booleancompressed) {
getW(output, offset);

if(compressed) {
if(output[offset] == (byte) 0x04) {
output[offset] = (byte) (((output[(short) (offset + 2 * curve.COORD_SIZE)] & 0xff) % 2) == 0 ? 2 : 3);
 }
return (short) (curve.COORD_SIZE + 1);
 }

if(output[offset] != (byte) 0x04) {
BigNaty = rm.EC_BN_C;
BigNatx = rm.EC_BN_D;
BigNatp = rm.EC_BN_E;
x.lock();
x.fromByteArray(output, (short) (offset + 1), curve.COORD_SIZE);

//Y^2 = X^3 + XA + B = x(x^2+A)+B
y.lock();
y.clone(x);
y.modSq(curve.pBN);
y.modAdd(curve.aBN, curve.pBN);
y.modMult(x, curve.pBN);
x.unlock();
y.modAdd(curve.bBN, curve.pBN);
y.modSqrt(curve.pBN);
p.lock();
booleanodd = y.isOdd();
if ((!odd && output[offset] != (byte) 0x02) || (odd && output[offset] != (byte) 0x03)) {
p.clone(curve.pBN);
p.subtract(y);
p.prependZeros(curve.COORD_SIZE, output, (short) (offset + curve.COORD_SIZE + 1));
 } else {
y.prependZeros(curve.COORD_SIZE, output, (short) (offset + curve.COORD_SIZE + 1));
 }
y.unlock();
p.unlock();
output[offset] = (byte) 0x04;
 }
return (short) (2 * curve.COORD_SIZE + 1);
 }



//
// ECKey methods
//
publicvoidsetFieldFP(byte[] bytes, shorts, shorts1) throwsCryptoException {
point.setFieldFP(bytes, s, s1);
 }

publicvoidsetFieldF2M(shorts) throwsCryptoException {
point.setFieldF2M(s);
 }

publicvoidsetFieldF2M(shorts, shorts1, shorts2) throwsCryptoException {
point.setFieldF2M(s, s1, s2);
 }

publicvoidsetA(byte[] bytes, shorts, shorts1) throwsCryptoException {
point.setA(bytes, s, s1);
 }

publicvoidsetB(byte[] bytes, shorts, shorts1) throwsCryptoException {
point.setB(bytes, s, s1);
 }

publicvoidsetG(byte[] bytes, shorts, shorts1) throwsCryptoException {
point.setG(bytes, s, s1);
 }

publicvoidsetR(byte[] bytes, shorts, shorts1) throwsCryptoException {
point.setR(bytes, s, s1);
 }

publicvoidsetK(shorts) {
point.setK(s);
 }

publicshortgetField(byte[] bytes, shorts) throwsCryptoException {
returnpoint.getField(bytes, s);
 }

publicshortgetA(byte[] bytes, shorts) throwsCryptoException {
returnpoint.getA(bytes, s);
 }

publicshortgetB(byte[] bytes, shorts) throwsCryptoException {
returnpoint.getB(bytes, s);
 }

publicshortgetG(byte[] bytes, shorts) throwsCryptoException {
returnpoint.getG(bytes, s);
 }

publicshortgetR(byte[] bytes, shorts) throwsCryptoException {
returnpoint.getR(bytes, s);
 }

publicshortgetK() throwsCryptoException {
returnpoint.getK();
 }
}