[PATCH] ec: add support for several more GOST curves

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

[PATCH] ec: add support for several more GOST curves

dbaryshkov
From: Dmitry Baryshkov <[hidden email]>

Add support for GOST curves defined by RFC 7836 and
draft-deremin-rfc4491-bis. Add aliases for 256-bit GOST curves (see
draft-smyshlyaev-tls12-gost-suites).

Sponsored by ROSA Linux.

Signed-off-by: Dmitry Baryshkov <[hidden email]>
---
 src/lib/libcrypto/ec/ec_curve.c       | 158 +++++++++++++++++++++++++-
 src/lib/libcrypto/objects/obj_mac.num |   6 +
 src/lib/libcrypto/objects/objects.txt |  10 +-
 3 files changed, 168 insertions(+), 6 deletions(-)

diff --git a/src/lib/libcrypto/ec/ec_curve.c b/src/lib/libcrypto/ec/ec_curve.c
index e075b1ed3ea5..a1bc88ee2cc6 100644
--- a/src/lib/libcrypto/ec/ec_curve.c
+++ b/src/lib/libcrypto/ec/ec_curve.c
@@ -2900,11 +2900,101 @@ static const struct {
  }
 };
 
+static const struct {
+ EC_CURVE_DATA h;
+ unsigned char data[0 + 32 * 6];
+}
+ _EC_GOST_2012_256_TC26_A = {
+ {
+ NID_X9_62_prime_field, 0, 32, 1
+ },
+ { /* no seed */
+ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, /* p */
+ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+ 0xFD, 0x97,
+ 0xc2, 0x17, 0x3f, 0x15, 0x13, 0x98, 0x16, 0x73, 0xaf, 0x48, /* a */
+ 0x92, 0xc2, 0x30, 0x35, 0xa2, 0x7c, 0xe2, 0x5e, 0x20, 0x13,
+ 0xbf, 0x95, 0xaa, 0x33, 0xb2, 0x2c, 0x65, 0x6f, 0x27, 0x7e,
+ 0x73, 0x35,
+ 0x29, 0x5f, 0x9b, 0xae, 0x74, 0x28, 0xed, 0x9c, 0xcc, 0x20, /* b */
+ 0xe7, 0xc3, 0x59, 0xa9, 0xd4, 0x1a, 0x22, 0xfc, 0xcd, 0x91,
+ 0x08, 0xe1, 0x7b, 0xf7, 0xba, 0x93, 0x37, 0xa6, 0xf8, 0xae,
+ 0x95, 0x13,
+ 0x91, 0xe3, 0x84, 0x43, 0xa5, 0xe8, 0x2c, 0x0d, 0x88, 0x09, /* x */
+ 0x23, 0x42, 0x57, 0x12, 0xb2, 0xbb, 0x65, 0x8b, 0x91, 0x96,
+ 0x93, 0x2e, 0x02, 0xc7, 0x8b, 0x25, 0x82, 0xfe, 0x74, 0x2d,
+ 0xaa, 0x28,
+ 0x32, 0x87, 0x94, 0x23, 0xab, 0x1a, 0x03, 0x75, 0x89, 0x57, /* y */
+ 0x86, 0xc4, 0xbb, 0x46, 0xe9, 0x56, 0x5f, 0xde, 0x0b, 0x53,
+ 0x44, 0x76, 0x67, 0x40, 0xaf, 0x26, 0x8a, 0xdb, 0x32, 0x32,
+ 0x2e, 0x5c,
+ 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* order */
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xd8, 0xcd, 0xdf,
+ 0xc8, 0x7b, 0x66, 0x35, 0xc1, 0x15, 0xaf, 0x55, 0x6c, 0x36,
+ 0x0c, 0x67,
+ }
+};
+
 static const struct {
  EC_CURVE_DATA h;
  unsigned char data[0 + 64 * 6];
 }
- _EC_GOST_2012_TC26_A = {
+ _EC_GOST_2012_512_Test = {
+ {
+ NID_X9_62_prime_field, 0, 64, 1
+ },
+ { /* no seed */
+ 0x45, 0x31, 0xac, 0xd1, 0xfe, 0x00, 0x23, 0xc7, 0x55, 0x0d, /* p */
+ 0x26, 0x7b, 0x6b, 0x2f, 0xee, 0x80, 0x92, 0x2b, 0x14, 0xb2,
+ 0xff, 0xb9, 0x0f, 0x04, 0xd4, 0xeb, 0x7c, 0x09, 0xb5, 0xd2,
+ 0xd1, 0x5d, 0xf1, 0xd8, 0x52, 0x74, 0x1a, 0xf4, 0x70, 0x4a,
+ 0x04, 0x58, 0x04, 0x7e, 0x80, 0xe4, 0x54, 0x6d, 0x35, 0xb8,
+ 0x33, 0x6f, 0xac, 0x22, 0x4d, 0xd8, 0x16, 0x64, 0xbb, 0xf5,
+ 0x28, 0xbe, 0x63, 0x73,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* a */
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x07,
+ 0x1c, 0xff, 0x08, 0x06, 0xa3, 0x11, 0x16, 0xda, 0x29, 0xd8, /* b */
+ 0xcf, 0xa5, 0x4e, 0x57, 0xeb, 0x74, 0x8b, 0xc5, 0xf3, 0x77,
+ 0xe4, 0x94, 0x00, 0xfd, 0xd7, 0x88, 0xb6, 0x49, 0xec, 0xa1,
+ 0xac, 0x43, 0x61, 0x83, 0x40, 0x13, 0xb2, 0xad, 0x73, 0x22,
+ 0x48, 0x0a, 0x89, 0xca, 0x58, 0xe0, 0xcf, 0x74, 0xbc, 0x9e,
+ 0x54, 0x0c, 0x2a, 0xdd, 0x68, 0x97, 0xfa, 0xd0, 0xa3, 0x08,
+ 0x4f, 0x30, 0x2a, 0xdc,
+ 0x24, 0xd1, 0x9c, 0xc6, 0x45, 0x72, 0xee, 0x30, 0xf3, 0x96, /* x */
+ 0xbf, 0x6e, 0xbb, 0xfd, 0x7a, 0x6c, 0x52, 0x13, 0xb3, 0xb3,
+ 0xd7, 0x05, 0x7c, 0xc8, 0x25, 0xf9, 0x10, 0x93, 0xa6, 0x8c,
+ 0xd7, 0x62, 0xfd, 0x60, 0x61, 0x12, 0x62, 0xcd, 0x83, 0x8d,
+ 0xc6, 0xb6, 0x0a, 0xa7, 0xee, 0xe8, 0x04, 0xe2, 0x8b, 0xc8,
+ 0x49, 0x97, 0x7f, 0xac, 0x33, 0xb4, 0xb5, 0x30, 0xf1, 0xb1,
+ 0x20, 0x24, 0x8a, 0x9a,
+ 0x2b, 0xb3, 0x12, 0xa4, 0x3b, 0xd2, 0xce, 0x6e, 0x0d, 0x02, /* y */
+ 0x06, 0x13, 0xc8, 0x57, 0xac, 0xdd, 0xcf, 0xbf, 0x06, 0x1e,
+ 0x91, 0xe5, 0xf2, 0xc3, 0xf3, 0x24, 0x47, 0xc2, 0x59, 0xf3,
+ 0x9b, 0x2c, 0x83, 0xab, 0x15, 0x6d, 0x77, 0xf1, 0x49, 0x6b,
+ 0xf7, 0xeb, 0x33, 0x51, 0xe1, 0xee, 0x4e, 0x43, 0xdc, 0x1a,
+ 0x18, 0xb9, 0x1b, 0x24, 0x64, 0x0b, 0x6d, 0xbb, 0x92, 0xcb,
+ 0x1a, 0xdd, 0x37, 0x1e,
+ 0x45, 0x31, 0xac, 0xd1, 0xfe, 0x00, 0x23, 0xc7, 0x55, 0x0d, /* order */
+ 0x26, 0x7b, 0x6b, 0x2f, 0xee, 0x80, 0x92, 0x2b, 0x14, 0xb2,
+ 0xff, 0xb9, 0x0f, 0x04, 0xd4, 0xeb, 0x7c, 0x09, 0xb5, 0xd2,
+ 0xd1, 0x5d, 0xa8, 0x2f, 0x2d, 0x7e, 0xcb, 0x1d, 0xba, 0xc7,
+ 0x19, 0x90, 0x5c, 0x5e, 0xec, 0xc4, 0x23, 0xf1, 0xd8, 0x6e,
+ 0x25, 0xed, 0xbe, 0x23, 0xc5, 0x95, 0xd6, 0x44, 0xaa, 0xf1,
+ 0x87, 0xe6, 0xe6, 0xdf,
+ }
+};
+
+static const struct {
+ EC_CURVE_DATA h;
+ unsigned char data[0 + 64 * 6];
+}
+ _EC_GOST_2012_512_TC26_A = {
  {
  NID_X9_62_prime_field, 0, 64, 1
  },
@@ -2958,7 +3048,7 @@ static const struct {
  EC_CURVE_DATA h;
  unsigned char data[0 + 64 * 6];
 }
- _EC_GOST_2012_TC26_B = {
+ _EC_GOST_2012_512_TC26_B = {
  {
  NID_X9_62_prime_field, 0, 64, 1
  },
@@ -3008,6 +3098,60 @@ static const struct {
  }
 };
 
+static const struct {
+ EC_CURVE_DATA h;
+ unsigned char data[0 + 64 * 6];
+}
+ _EC_GOST_2012_512_TC26_C = {
+ {
+ NID_X9_62_prime_field, 0, 64, 1
+ },
+ { /* no seed */
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* p */
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xfd, 0xc7,
+ 0xdc, 0x92, 0x03, 0xe5, 0x14, 0xa7, 0x21, 0x87, 0x54, 0x85, /* a */
+ 0xa5, 0x29, 0xd2, 0xc7, 0x22, 0xfb, 0x18, 0x7b, 0xc8, 0x98,
+ 0x0e, 0xb8, 0x66, 0x64, 0x4d, 0xe4, 0x1c, 0x68, 0xe1, 0x43,
+ 0x06, 0x45, 0x46, 0xe8, 0x61, 0xc0, 0xe2, 0xc9, 0xed, 0xd9,
+ 0x2a, 0xde, 0x71, 0xf4, 0x6f, 0xcf, 0x50, 0xff, 0x2a, 0xd9,
+ 0x7f, 0x95, 0x1f, 0xda, 0x9f, 0x2a, 0x2e, 0xb6, 0x54, 0x6f,
+ 0x39, 0x68, 0x9b, 0xd3,
+ 0xb4, 0xc4, 0xee, 0x28, 0xce, 0xbc, 0x6c, 0x2c, 0x8a, 0xc1, /* b */
+ 0x29, 0x52, 0xcf, 0x37, 0xf1, 0x6a, 0xc7, 0xef, 0xb6, 0xa9,
+ 0xf6, 0x9f, 0x4b, 0x57, 0xff, 0xda, 0x2e, 0x4f, 0x0d, 0xe5,
+ 0xad, 0xe0, 0x38, 0xcb, 0xc2, 0xff, 0xf7, 0x19, 0xd2, 0xc1,
+ 0x8d, 0xe0, 0x28, 0x4b, 0x8b, 0xfe, 0xf3, 0xb5, 0x2b, 0x8c,
+ 0xc7, 0xa5, 0xf5, 0xbf, 0x0a, 0x3c, 0x8d, 0x23, 0x19, 0xa5,
+ 0x31, 0x25, 0x57, 0xe1,
+ 0xe2, 0xe3, 0x1e, 0xdf, 0xc2, 0x3d, 0xe7, 0xbd, 0xeb, 0xe2, /* x */
+ 0x41, 0xce, 0x59, 0x3e, 0xf5, 0xde, 0x22, 0x95, 0xb7, 0xa9,
+ 0xcb, 0xae, 0xf0, 0x21, 0xd3, 0x85, 0xf7, 0x07, 0x4c, 0xea,
+ 0x04, 0x3a, 0xa2, 0x72, 0x72, 0xa7, 0xae, 0x60, 0x2b, 0xf2,
+ 0xa7, 0xb9, 0x03, 0x3d, 0xb9, 0xed, 0x36, 0x10, 0xc6, 0xfb,
+ 0x85, 0x48, 0x7e, 0xae, 0x97, 0xaa, 0xc5, 0xbc, 0x79, 0x28,
+ 0xc1, 0x95, 0x01, 0x48,
+ 0xf5, 0xce, 0x40, 0xd9, 0x5b, 0x5e, 0xb8, 0x99, 0xab, 0xbc, /* y */
+ 0xcf, 0xf5, 0x91, 0x1c, 0xb8, 0x57, 0x79, 0x39, 0x80, 0x4d,
+ 0x65, 0x27, 0x37, 0x8b, 0x8c, 0x10, 0x8c, 0x3d, 0x20, 0x90,
+ 0xff, 0x9b, 0xe1, 0x8e, 0x2d, 0x33, 0xe3, 0x02, 0x1e, 0xd2,
+ 0xef, 0x32, 0xd8, 0x58, 0x22, 0x42, 0x3b, 0x63, 0x04, 0xf7,
+ 0x26, 0xaa, 0x85, 0x4b, 0xae, 0x07, 0xd0, 0x39, 0x6e, 0x9a,
+ 0x9a, 0xdd, 0xc4, 0x0f,
+ 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* order */
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xc9, 0x8c, 0xdb, 0xa4, 0x65, 0x06, 0xab, 0x00,
+ 0x4c, 0x33, 0xa9, 0xff, 0x51, 0x47, 0x50, 0x2c, 0xc8, 0xed,
+ 0xa9, 0xe7, 0xa7, 0x69, 0xa1, 0x26, 0x94, 0x62, 0x3c, 0xef,
+ 0x47, 0xf0, 0x23, 0xed,
+ }
+};
+
 #endif
 
 typedef struct _ec_list_element_st {
@@ -3147,8 +3291,14 @@ static const ec_list_element curve_list[] = {
  {NID_id_GostR3410_2001_CryptoPro_C_ParamSet, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2001 CryptoPro-C"},
  {NID_id_GostR3410_2001_CryptoPro_XchA_ParamSet, &_EC_GOST_2001_CryptoPro_A.h, 0, "GOST R 34.10-2001 CryptoPro-XchA"},
  {NID_id_GostR3410_2001_CryptoPro_XchB_ParamSet, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2001 CryptoPro-XchB"},
- {NID_id_tc26_gost_3410_2012_512_paramSetA, &_EC_GOST_2012_TC26_A.h, 0, "GOST R 34.10-2012 TC26-A"},
- {NID_id_tc26_gost_3410_2012_512_paramSetB, &_EC_GOST_2012_TC26_B.h, 0, "GOST R 34.10-2012 TC26-B"},
+ {NID_id_tc26_gost_3410_2012_256_paramSetA, &_EC_GOST_2012_256_TC26_A.h, 0, "GOST R 34.10-2012 256 TC26-A"},
+ {NID_id_tc26_gost_3410_2012_256_paramSetB, &_EC_GOST_2001_CryptoPro_A.h, 0, "GOST R 34.10-2001 512 TC26-B"},
+ {NID_id_tc26_gost_3410_2012_256_paramSetC, &_EC_GOST_2001_CryptoPro_B.h, 0, "GOST R 34.10-2001 512 TC26-C"},
+ {NID_id_tc26_gost_3410_2012_256_paramSetD, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2012 512 TC26-D"},
+ {NID_id_tc26_gost_3410_2012_512_paramSetTest, &_EC_GOST_2012_512_Test.h, 0, "GOST R 34.10-2012 512 Test Curve"},
+ {NID_id_tc26_gost_3410_2012_512_paramSetA, &_EC_GOST_2012_512_TC26_A.h, 0, "GOST R 34.10-2012 512 TC26-A"},
+ {NID_id_tc26_gost_3410_2012_512_paramSetB, &_EC_GOST_2012_512_TC26_B.h, 0, "GOST R 34.10-2012 512 TC26-B"},
+ {NID_id_tc26_gost_3410_2012_512_paramSetC, &_EC_GOST_2012_512_TC26_C.h, 0, "GOST R 34.10-2012 512 TC26-C"},
 #endif
 };
 
diff --git a/src/lib/libcrypto/objects/obj_mac.num b/src/lib/libcrypto/objects/obj_mac.num
index 8405ba5e319b..a7cfe548d6bd 100644
--- a/src/lib/libcrypto/objects/obj_mac.num
+++ b/src/lib/libcrypto/objects/obj_mac.num
@@ -990,3 +990,9 @@ dhSinglePass_cofactorDH_sha512kdf_scheme 989
 dh_std_kdf 990
 dh_cofactor_kdf 991
 pSpecified 992
+id_tc26_gost_3410_2012_256_paramSetA 993
+id_tc26_gost_3410_2012_256_paramSetB 994
+id_tc26_gost_3410_2012_256_paramSetC 995
+id_tc26_gost_3410_2012_256_paramSetD 996
+id_tc26_gost_3410_2012_512_paramSetTest 997
+id_tc26_gost_3410_2012_512_paramSetC 998
diff --git a/src/lib/libcrypto/objects/objects.txt b/src/lib/libcrypto/objects/objects.txt
index ea7700724f00..e097c50e696b 100644
--- a/src/lib/libcrypto/objects/objects.txt
+++ b/src/lib/libcrypto/objects/objects.txt
@@ -1372,8 +1372,14 @@ member-body 643 7 1 : tc26
 tc26 1 2 2 : streebog256 : GOST R 34.11-2012 (256 bit)
 !Cname id-tc26-gost3411-2012-512
 tc26 1 2 3 : streebog512 : GOST R 34-11-2012 (512 bit)
-tc26 2 1 2 1 : id-tc26-gost-3410-2012-512-paramSetA
-tc26 2 1 2 2 : id-tc26-gost-3410-2012-512-paramSetB
+tc26 2 1 1 1 : id-tc26-gost-3410-2012-256-paramSetA : GOST R 34.10-2012 (256 bit) ParamSet A
+tc26 2 1 1 2 : id-tc26-gost-3410-2012-256-paramSetB : GOST R 34.10-2012 (256 bit) ParamSet B
+tc26 2 1 1 3 : id-tc26-gost-3410-2012-256-paramSetC : GOST R 34.10-2012 (256 bit) ParamSet C
+tc26 2 1 1 4 : id-tc26-gost-3410-2012-256-paramSetD : GOST R 34.10-2012 (256 bit) ParamSet D
+tc26 2 1 2 0 : id-tc26-gost-3410-2012-512-paramSetTest : GOST R 34.10-2012 (512 bit) testing parameter set
+tc26 2 1 2 1 : id-tc26-gost-3410-2012-512-paramSetA : GOST R 34.10-2012 (512 bit) ParamSet A
+tc26 2 1 2 2 : id-tc26-gost-3410-2012-512-paramSetB : GOST R 34.10-2012 (512 bit) ParamSet B
+tc26 2 1 2 3 : id-tc26-gost-3410-2012-512-paramSetC : GOST R 34.10-2012 (512 bit) ParamSet C
 tc26 2 5 1 1 : id-tc26-gost-28147-param-Z
 tc26 1 1 1 : id-tc26-gost3410-2012-256 : GOST R 34.10-2012 (256 bit)
 tc26 1 1 2 : id-tc26-gost3410-2012-512 : GOST R 34.10-2012 (512 bit)
--
2.25.1

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] ec: add support for several more GOST curves

kinichiro inoguchi
Hi,

I have a 3 questions,
- parameter set values for Twisted Edwards
- description in _ec_list_element_st
- naming about object identifier

details are described below.


On Thu, Mar 26, 2020 at 09:25:57PM +0300, [hidden email] wrote:

> From: Dmitry Baryshkov <[hidden email]>
>
> Add support for GOST curves defined by RFC 7836 and
> draft-deremin-rfc4491-bis. Add aliases for 256-bit GOST curves (see
> draft-smyshlyaev-tls12-gost-suites).
>
> Sponsored by ROSA Linux.
>
> Signed-off-by: Dmitry Baryshkov <[hidden email]>
> ---
>  src/lib/libcrypto/ec/ec_curve.c       | 158 +++++++++++++++++++++++++-
>  src/lib/libcrypto/objects/obj_mac.num |   6 +
>  src/lib/libcrypto/objects/objects.txt |  10 +-
>  3 files changed, 168 insertions(+), 6 deletions(-)
>
> diff --git a/src/lib/libcrypto/ec/ec_curve.c b/src/lib/libcrypto/ec/ec_curve.c
> index e075b1ed3ea5..a1bc88ee2cc6 100644
> --- a/src/lib/libcrypto/ec/ec_curve.c
> +++ b/src/lib/libcrypto/ec/ec_curve.c
> @@ -2900,11 +2900,101 @@ static const struct {
>   }
>  };
>  
> +static const struct {
> + EC_CURVE_DATA h;
> + unsigned char data[0 + 32 * 6];
> +}
> + _EC_GOST_2012_256_TC26_A = {
> + {
> + NID_X9_62_prime_field, 0, 32, 1
> + },
> + { /* no seed */
> + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, /* p */
> + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
> + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
> + 0xFD, 0x97,
> + 0xc2, 0x17, 0x3f, 0x15, 0x13, 0x98, 0x16, 0x73, 0xaf, 0x48, /* a */
> + 0x92, 0xc2, 0x30, 0x35, 0xa2, 0x7c, 0xe2, 0x5e, 0x20, 0x13,
> + 0xbf, 0x95, 0xaa, 0x33, 0xb2, 0x2c, 0x65, 0x6f, 0x27, 0x7e,
> + 0x73, 0x35,
> + 0x29, 0x5f, 0x9b, 0xae, 0x74, 0x28, 0xed, 0x9c, 0xcc, 0x20, /* b */
> + 0xe7, 0xc3, 0x59, 0xa9, 0xd4, 0x1a, 0x22, 0xfc, 0xcd, 0x91,
> + 0x08, 0xe1, 0x7b, 0xf7, 0xba, 0x93, 0x37, 0xa6, 0xf8, 0xae,
> + 0x95, 0x13,
> + 0x91, 0xe3, 0x84, 0x43, 0xa5, 0xe8, 0x2c, 0x0d, 0x88, 0x09, /* x */
> + 0x23, 0x42, 0x57, 0x12, 0xb2, 0xbb, 0x65, 0x8b, 0x91, 0x96,
> + 0x93, 0x2e, 0x02, 0xc7, 0x8b, 0x25, 0x82, 0xfe, 0x74, 0x2d,
> + 0xaa, 0x28,
> + 0x32, 0x87, 0x94, 0x23, 0xab, 0x1a, 0x03, 0x75, 0x89, 0x57, /* y */
> + 0x86, 0xc4, 0xbb, 0x46, 0xe9, 0x56, 0x5f, 0xde, 0x0b, 0x53,
> + 0x44, 0x76, 0x67, 0x40, 0xaf, 0x26, 0x8a, 0xdb, 0x32, 0x32,
> + 0x2e, 0x5c,
> + 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* order */
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xd8, 0xcd, 0xdf,
> + 0xc8, 0x7b, 0x66, 0x35, 0xc1, 0x15, 0xaf, 0x55, 0x6c, 0x36,
> + 0x0c, 0x67,
> + }
> +};
> +


This diff adds * below, and 2 Twisted Edwards one misses m,e,d,u,v.
Is this as you expected for now ?

  Canonical:
  *id-tc26-gost-3410-2012-512-paramSetTest order = m = q
   id-tc26-gost-3410-2012-512-paramSetA    order = m = q
   id-tc26-gost-3410-2012-512-paramSetB    order = m = q

  Twisted Edwards:
  *id-tc26-gost-3410-2012-512-paramSetC    order = q, misses m,e,d,u,v
  *id-tc26-gost-3410-2012-256-paramSetA    order = q, misses m,e,d,u,v


>  static const struct {
>   EC_CURVE_DATA h;
>   unsigned char data[0 + 64 * 6];
>  }
> - _EC_GOST_2012_TC26_A = {
> + _EC_GOST_2012_512_Test = {
> + {
> + NID_X9_62_prime_field, 0, 64, 1
> + },
> + { /* no seed */
> + 0x45, 0x31, 0xac, 0xd1, 0xfe, 0x00, 0x23, 0xc7, 0x55, 0x0d, /* p */
> + 0x26, 0x7b, 0x6b, 0x2f, 0xee, 0x80, 0x92, 0x2b, 0x14, 0xb2,
> + 0xff, 0xb9, 0x0f, 0x04, 0xd4, 0xeb, 0x7c, 0x09, 0xb5, 0xd2,
> + 0xd1, 0x5d, 0xf1, 0xd8, 0x52, 0x74, 0x1a, 0xf4, 0x70, 0x4a,
> + 0x04, 0x58, 0x04, 0x7e, 0x80, 0xe4, 0x54, 0x6d, 0x35, 0xb8,
> + 0x33, 0x6f, 0xac, 0x22, 0x4d, 0xd8, 0x16, 0x64, 0xbb, 0xf5,
> + 0x28, 0xbe, 0x63, 0x73,
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* a */
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> + 0x00, 0x00, 0x00, 0x07,
> + 0x1c, 0xff, 0x08, 0x06, 0xa3, 0x11, 0x16, 0xda, 0x29, 0xd8, /* b */
> + 0xcf, 0xa5, 0x4e, 0x57, 0xeb, 0x74, 0x8b, 0xc5, 0xf3, 0x77,
> + 0xe4, 0x94, 0x00, 0xfd, 0xd7, 0x88, 0xb6, 0x49, 0xec, 0xa1,
> + 0xac, 0x43, 0x61, 0x83, 0x40, 0x13, 0xb2, 0xad, 0x73, 0x22,
> + 0x48, 0x0a, 0x89, 0xca, 0x58, 0xe0, 0xcf, 0x74, 0xbc, 0x9e,
> + 0x54, 0x0c, 0x2a, 0xdd, 0x68, 0x97, 0xfa, 0xd0, 0xa3, 0x08,
> + 0x4f, 0x30, 0x2a, 0xdc,
> + 0x24, 0xd1, 0x9c, 0xc6, 0x45, 0x72, 0xee, 0x30, 0xf3, 0x96, /* x */
> + 0xbf, 0x6e, 0xbb, 0xfd, 0x7a, 0x6c, 0x52, 0x13, 0xb3, 0xb3,
> + 0xd7, 0x05, 0x7c, 0xc8, 0x25, 0xf9, 0x10, 0x93, 0xa6, 0x8c,
> + 0xd7, 0x62, 0xfd, 0x60, 0x61, 0x12, 0x62, 0xcd, 0x83, 0x8d,
> + 0xc6, 0xb6, 0x0a, 0xa7, 0xee, 0xe8, 0x04, 0xe2, 0x8b, 0xc8,
> + 0x49, 0x97, 0x7f, 0xac, 0x33, 0xb4, 0xb5, 0x30, 0xf1, 0xb1,
> + 0x20, 0x24, 0x8a, 0x9a,
> + 0x2b, 0xb3, 0x12, 0xa4, 0x3b, 0xd2, 0xce, 0x6e, 0x0d, 0x02, /* y */
> + 0x06, 0x13, 0xc8, 0x57, 0xac, 0xdd, 0xcf, 0xbf, 0x06, 0x1e,
> + 0x91, 0xe5, 0xf2, 0xc3, 0xf3, 0x24, 0x47, 0xc2, 0x59, 0xf3,
> + 0x9b, 0x2c, 0x83, 0xab, 0x15, 0x6d, 0x77, 0xf1, 0x49, 0x6b,
> + 0xf7, 0xeb, 0x33, 0x51, 0xe1, 0xee, 0x4e, 0x43, 0xdc, 0x1a,
> + 0x18, 0xb9, 0x1b, 0x24, 0x64, 0x0b, 0x6d, 0xbb, 0x92, 0xcb,
> + 0x1a, 0xdd, 0x37, 0x1e,
> + 0x45, 0x31, 0xac, 0xd1, 0xfe, 0x00, 0x23, 0xc7, 0x55, 0x0d, /* order */
> + 0x26, 0x7b, 0x6b, 0x2f, 0xee, 0x80, 0x92, 0x2b, 0x14, 0xb2,
> + 0xff, 0xb9, 0x0f, 0x04, 0xd4, 0xeb, 0x7c, 0x09, 0xb5, 0xd2,
> + 0xd1, 0x5d, 0xa8, 0x2f, 0x2d, 0x7e, 0xcb, 0x1d, 0xba, 0xc7,
> + 0x19, 0x90, 0x5c, 0x5e, 0xec, 0xc4, 0x23, 0xf1, 0xd8, 0x6e,
> + 0x25, 0xed, 0xbe, 0x23, 0xc5, 0x95, 0xd6, 0x44, 0xaa, 0xf1,
> + 0x87, 0xe6, 0xe6, 0xdf,
> + }
> +};
> +
> +static const struct {
> + EC_CURVE_DATA h;
> + unsigned char data[0 + 64 * 6];
> +}
> + _EC_GOST_2012_512_TC26_A = {
>   {
>   NID_X9_62_prime_field, 0, 64, 1
>   },
> @@ -2958,7 +3048,7 @@ static const struct {
>   EC_CURVE_DATA h;
>   unsigned char data[0 + 64 * 6];
>  }
> - _EC_GOST_2012_TC26_B = {
> + _EC_GOST_2012_512_TC26_B = {
>   {
>   NID_X9_62_prime_field, 0, 64, 1
>   },
> @@ -3008,6 +3098,60 @@ static const struct {
>   }
>  };
>  
> +static const struct {
> + EC_CURVE_DATA h;
> + unsigned char data[0 + 64 * 6];
> +}
> + _EC_GOST_2012_512_TC26_C = {
> + {
> + NID_X9_62_prime_field, 0, 64, 1
> + },
> + { /* no seed */
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* p */
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xfd, 0xc7,
> + 0xdc, 0x92, 0x03, 0xe5, 0x14, 0xa7, 0x21, 0x87, 0x54, 0x85, /* a */
> + 0xa5, 0x29, 0xd2, 0xc7, 0x22, 0xfb, 0x18, 0x7b, 0xc8, 0x98,
> + 0x0e, 0xb8, 0x66, 0x64, 0x4d, 0xe4, 0x1c, 0x68, 0xe1, 0x43,
> + 0x06, 0x45, 0x46, 0xe8, 0x61, 0xc0, 0xe2, 0xc9, 0xed, 0xd9,
> + 0x2a, 0xde, 0x71, 0xf4, 0x6f, 0xcf, 0x50, 0xff, 0x2a, 0xd9,
> + 0x7f, 0x95, 0x1f, 0xda, 0x9f, 0x2a, 0x2e, 0xb6, 0x54, 0x6f,
> + 0x39, 0x68, 0x9b, 0xd3,
> + 0xb4, 0xc4, 0xee, 0x28, 0xce, 0xbc, 0x6c, 0x2c, 0x8a, 0xc1, /* b */
> + 0x29, 0x52, 0xcf, 0x37, 0xf1, 0x6a, 0xc7, 0xef, 0xb6, 0xa9,
> + 0xf6, 0x9f, 0x4b, 0x57, 0xff, 0xda, 0x2e, 0x4f, 0x0d, 0xe5,
> + 0xad, 0xe0, 0x38, 0xcb, 0xc2, 0xff, 0xf7, 0x19, 0xd2, 0xc1,
> + 0x8d, 0xe0, 0x28, 0x4b, 0x8b, 0xfe, 0xf3, 0xb5, 0x2b, 0x8c,
> + 0xc7, 0xa5, 0xf5, 0xbf, 0x0a, 0x3c, 0x8d, 0x23, 0x19, 0xa5,
> + 0x31, 0x25, 0x57, 0xe1,
> + 0xe2, 0xe3, 0x1e, 0xdf, 0xc2, 0x3d, 0xe7, 0xbd, 0xeb, 0xe2, /* x */
> + 0x41, 0xce, 0x59, 0x3e, 0xf5, 0xde, 0x22, 0x95, 0xb7, 0xa9,
> + 0xcb, 0xae, 0xf0, 0x21, 0xd3, 0x85, 0xf7, 0x07, 0x4c, 0xea,
> + 0x04, 0x3a, 0xa2, 0x72, 0x72, 0xa7, 0xae, 0x60, 0x2b, 0xf2,
> + 0xa7, 0xb9, 0x03, 0x3d, 0xb9, 0xed, 0x36, 0x10, 0xc6, 0xfb,
> + 0x85, 0x48, 0x7e, 0xae, 0x97, 0xaa, 0xc5, 0xbc, 0x79, 0x28,
> + 0xc1, 0x95, 0x01, 0x48,
> + 0xf5, 0xce, 0x40, 0xd9, 0x5b, 0x5e, 0xb8, 0x99, 0xab, 0xbc, /* y */
> + 0xcf, 0xf5, 0x91, 0x1c, 0xb8, 0x57, 0x79, 0x39, 0x80, 0x4d,
> + 0x65, 0x27, 0x37, 0x8b, 0x8c, 0x10, 0x8c, 0x3d, 0x20, 0x90,
> + 0xff, 0x9b, 0xe1, 0x8e, 0x2d, 0x33, 0xe3, 0x02, 0x1e, 0xd2,
> + 0xef, 0x32, 0xd8, 0x58, 0x22, 0x42, 0x3b, 0x63, 0x04, 0xf7,
> + 0x26, 0xaa, 0x85, 0x4b, 0xae, 0x07, 0xd0, 0x39, 0x6e, 0x9a,
> + 0x9a, 0xdd, 0xc4, 0x0f,
> + 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* order */
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
> + 0xff, 0xff, 0xc9, 0x8c, 0xdb, 0xa4, 0x65, 0x06, 0xab, 0x00,
> + 0x4c, 0x33, 0xa9, 0xff, 0x51, 0x47, 0x50, 0x2c, 0xc8, 0xed,
> + 0xa9, 0xe7, 0xa7, 0x69, 0xa1, 0x26, 0x94, 0x62, 0x3c, 0xef,
> + 0x47, 0xf0, 0x23, 0xed,
> + }
> +};


Same as mentioned before.


> +
>  #endif
>  
>  typedef struct _ec_list_element_st {
> @@ -3147,8 +3291,14 @@ static const ec_list_element curve_list[] = {
>   {NID_id_GostR3410_2001_CryptoPro_C_ParamSet, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2001 CryptoPro-C"},
>   {NID_id_GostR3410_2001_CryptoPro_XchA_ParamSet, &_EC_GOST_2001_CryptoPro_A.h, 0, "GOST R 34.10-2001 CryptoPro-XchA"},
>   {NID_id_GostR3410_2001_CryptoPro_XchB_ParamSet, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2001 CryptoPro-XchB"},
> - {NID_id_tc26_gost_3410_2012_512_paramSetA, &_EC_GOST_2012_TC26_A.h, 0, "GOST R 34.10-2012 TC26-A"},
> - {NID_id_tc26_gost_3410_2012_512_paramSetB, &_EC_GOST_2012_TC26_B.h, 0, "GOST R 34.10-2012 TC26-B"},
> + {NID_id_tc26_gost_3410_2012_256_paramSetA, &_EC_GOST_2012_256_TC26_A.h, 0, "GOST R 34.10-2012 256 TC26-A"},
> + {NID_id_tc26_gost_3410_2012_256_paramSetB, &_EC_GOST_2001_CryptoPro_A.h, 0, "GOST R 34.10-2001 512 TC26-B"},
> + {NID_id_tc26_gost_3410_2012_256_paramSetC, &_EC_GOST_2001_CryptoPro_B.h, 0, "GOST R 34.10-2001 512 TC26-C"},
> + {NID_id_tc26_gost_3410_2012_256_paramSetD, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2012 512 TC26-D"},


Are the 4th parameter above respectively
"GOST R 34.10-2012 256 TC26-B" ?
"GOST R 34.10-2012 256 TC26-C" ?
"GOST R 34.10-2012 256 TC26-D" ?


> + {NID_id_tc26_gost_3410_2012_512_paramSetTest, &_EC_GOST_2012_512_Test.h, 0, "GOST R 34.10-2012 512 Test Curve"},
> + {NID_id_tc26_gost_3410_2012_512_paramSetA, &_EC_GOST_2012_512_TC26_A.h, 0, "GOST R 34.10-2012 512 TC26-A"},
> + {NID_id_tc26_gost_3410_2012_512_paramSetB, &_EC_GOST_2012_512_TC26_B.h, 0, "GOST R 34.10-2012 512 TC26-B"},
> + {NID_id_tc26_gost_3410_2012_512_paramSetC, &_EC_GOST_2012_512_TC26_C.h, 0, "GOST R 34.10-2012 512 TC26-C"},
>  #endif
>  };
>  
> diff --git a/src/lib/libcrypto/objects/obj_mac.num b/src/lib/libcrypto/objects/obj_mac.num
> index 8405ba5e319b..a7cfe548d6bd 100644
> --- a/src/lib/libcrypto/objects/obj_mac.num
> +++ b/src/lib/libcrypto/objects/obj_mac.num
> @@ -990,3 +990,9 @@ dhSinglePass_cofactorDH_sha512kdf_scheme 989
>  dh_std_kdf 990
>  dh_cofactor_kdf 991
>  pSpecified 992
> +id_tc26_gost_3410_2012_256_paramSetA 993
> +id_tc26_gost_3410_2012_256_paramSetB 994
> +id_tc26_gost_3410_2012_256_paramSetC 995
> +id_tc26_gost_3410_2012_256_paramSetD 996
> +id_tc26_gost_3410_2012_512_paramSetTest 997
> +id_tc26_gost_3410_2012_512_paramSetC 998
> diff --git a/src/lib/libcrypto/objects/objects.txt b/src/lib/libcrypto/objects/objects.txt
> index ea7700724f00..e097c50e696b 100644
> --- a/src/lib/libcrypto/objects/objects.txt
> +++ b/src/lib/libcrypto/objects/objects.txt
> @@ -1372,8 +1372,14 @@ member-body 643 7 1 : tc26
>  tc26 1 2 2 : streebog256 : GOST R 34.11-2012 (256 bit)
>  !Cname id-tc26-gost3411-2012-512
>  tc26 1 2 3 : streebog512 : GOST R 34-11-2012 (512 bit)
> -tc26 2 1 2 1 : id-tc26-gost-3410-2012-512-paramSetA
> -tc26 2 1 2 2 : id-tc26-gost-3410-2012-512-paramSetB
> +tc26 2 1 1 1 : id-tc26-gost-3410-2012-256-paramSetA : GOST R 34.10-2012 (256 bit) ParamSet A
> +tc26 2 1 1 2 : id-tc26-gost-3410-2012-256-paramSetB : GOST R 34.10-2012 (256 bit) ParamSet B
> +tc26 2 1 1 3 : id-tc26-gost-3410-2012-256-paramSetC : GOST R 34.10-2012 (256 bit) ParamSet C
> +tc26 2 1 1 4 : id-tc26-gost-3410-2012-256-paramSetD : GOST R 34.10-2012 (256 bit) ParamSet D
> +tc26 2 1 2 0 : id-tc26-gost-3410-2012-512-paramSetTest : GOST R 34.10-2012 (512 bit) testing parameter set
> +tc26 2 1 2 1 : id-tc26-gost-3410-2012-512-paramSetA : GOST R 34.10-2012 (512 bit) ParamSet A
> +tc26 2 1 2 2 : id-tc26-gost-3410-2012-512-paramSetB : GOST R 34.10-2012 (512 bit) ParamSet B


These 2 are added in obj_mac.num and objects.txt (-2012-).
  id-tc26-gost-3410-2012-512-paramSetA
  id-tc26-gost-3410-2012-512-paramSetB

But in RFC7836 these 2 parameter set object identifiers are described (-12-),
  id-tc26-gost-3410-12-512-paramSetA
  id-tc26-gost-3410-12-512-paramSetB

Is -2012- right ?
I thought this diff would be right and RFC should be fixed.


> +tc26 2 1 2 3 : id-tc26-gost-3410-2012-512-paramSetC : GOST R 34.10-2012 (512 bit) ParamSet C
>  tc26 2 5 1 1 : id-tc26-gost-28147-param-Z
>  tc26 1 1 1 : id-tc26-gost3410-2012-256 : GOST R 34.10-2012 (256 bit)
>  tc26 1 1 2 : id-tc26-gost3410-2012-512 : GOST R 34.10-2012 (512 bit)
> --
> 2.25.1
>

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] ec: add support for several more GOST curves

dbaryshkov
сб, 28 мар. 2020 г. в 11:30, Kinichiro Inoguchi <[hidden email]>:

>
> Hi,
>
> I have a 3 questions,
> - parameter set values for Twisted Edwards
> - description in _ec_list_element_st
> - naming about object identifier
>
> details are described below.
>
>
> On Thu, Mar 26, 2020 at 09:25:57PM +0300, [hidden email] wrote:
> > From: Dmitry Baryshkov <[hidden email]>
> >
> > Add support for GOST curves defined by RFC 7836 and
> > draft-deremin-rfc4491-bis. Add aliases for 256-bit GOST curves (see
> > draft-smyshlyaev-tls12-gost-suites).
> >
> > Sponsored by ROSA Linux.
> >
> > Signed-off-by: Dmitry Baryshkov <[hidden email]>
> > ---
> >  src/lib/libcrypto/ec/ec_curve.c       | 158 +++++++++++++++++++++++++-
> >  src/lib/libcrypto/objects/obj_mac.num |   6 +
> >  src/lib/libcrypto/objects/objects.txt |  10 +-
> >  3 files changed, 168 insertions(+), 6 deletions(-)
> >
> > diff --git a/src/lib/libcrypto/ec/ec_curve.c b/src/lib/libcrypto/ec/ec_curve.c
> > index e075b1ed3ea5..a1bc88ee2cc6 100644
> > --- a/src/lib/libcrypto/ec/ec_curve.c
> > +++ b/src/lib/libcrypto/ec/ec_curve.c
> > @@ -2900,11 +2900,101 @@ static const struct {
> >       }
> >  };
> >
> > +static const struct {
> > +     EC_CURVE_DATA h;
> > +     unsigned char data[0 + 32 * 6];
> > +}
> > + _EC_GOST_2012_256_TC26_A = {
> > +     {
> > +             NID_X9_62_prime_field, 0, 32, 1
> > +     },
> > +     {                       /* no seed */
> > +             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,     /* p */
> > +             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
> > +             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
> > +             0xFD, 0x97,
> > +             0xc2, 0x17, 0x3f, 0x15, 0x13, 0x98, 0x16, 0x73, 0xaf, 0x48,     /* a */
> > +             0x92, 0xc2, 0x30, 0x35, 0xa2, 0x7c, 0xe2, 0x5e, 0x20, 0x13,
> > +             0xbf, 0x95, 0xaa, 0x33, 0xb2, 0x2c, 0x65, 0x6f, 0x27, 0x7e,
> > +             0x73, 0x35,
> > +             0x29, 0x5f, 0x9b, 0xae, 0x74, 0x28, 0xed, 0x9c, 0xcc, 0x20,     /* b */
> > +             0xe7, 0xc3, 0x59, 0xa9, 0xd4, 0x1a, 0x22, 0xfc, 0xcd, 0x91,
> > +             0x08, 0xe1, 0x7b, 0xf7, 0xba, 0x93, 0x37, 0xa6, 0xf8, 0xae,
> > +             0x95, 0x13,
> > +             0x91, 0xe3, 0x84, 0x43, 0xa5, 0xe8, 0x2c, 0x0d, 0x88, 0x09,     /* x */
> > +             0x23, 0x42, 0x57, 0x12, 0xb2, 0xbb, 0x65, 0x8b, 0x91, 0x96,
> > +             0x93, 0x2e, 0x02, 0xc7, 0x8b, 0x25, 0x82, 0xfe, 0x74, 0x2d,
> > +             0xaa, 0x28,
> > +             0x32, 0x87, 0x94, 0x23, 0xab, 0x1a, 0x03, 0x75, 0x89, 0x57,     /* y */
> > +             0x86, 0xc4, 0xbb, 0x46, 0xe9, 0x56, 0x5f, 0xde, 0x0b, 0x53,
> > +             0x44, 0x76, 0x67, 0x40, 0xaf, 0x26, 0x8a, 0xdb, 0x32, 0x32,
> > +             0x2e, 0x5c,
> > +             0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     /* order */
> > +             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xd8, 0xcd, 0xdf,
> > +             0xc8, 0x7b, 0x66, 0x35, 0xc1, 0x15, 0xaf, 0x55, 0x6c, 0x36,
> > +             0x0c, 0x67,
> > +     }
> > +};
> > +
>
>
> This diff adds * below, and 2 Twisted Edwards one misses m,e,d,u,v.
> Is this as you expected for now ?
>
>   Canonical:
>   *id-tc26-gost-3410-2012-512-paramSetTest order = m = q
>    id-tc26-gost-3410-2012-512-paramSetA    order = m = q
>    id-tc26-gost-3410-2012-512-paramSetB    order = m = q
>
>   Twisted Edwards:
>   *id-tc26-gost-3410-2012-512-paramSetC    order = q, misses m,e,d,u,v
>   *id-tc26-gost-3410-2012-256-paramSetA    order = q, misses m,e,d,u,v

This is expected. These curves are defined in Weierstrass form (a, b,
x, y) and in birationally equivalent Twisted Edwards form (e, d, u,
v). One can perform calculations in any of these forms. In this RFC m
= order of a whole curve, q is an order of the subgroup. Version 2 of
the patch will fix cofactors.


> >  #endif
> >
> >  typedef struct _ec_list_element_st {
> > @@ -3147,8 +3291,14 @@ static const ec_list_element curve_list[] = {
> >       {NID_id_GostR3410_2001_CryptoPro_C_ParamSet, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2001 CryptoPro-C"},
> >       {NID_id_GostR3410_2001_CryptoPro_XchA_ParamSet, &_EC_GOST_2001_CryptoPro_A.h, 0, "GOST R 34.10-2001 CryptoPro-XchA"},
> >       {NID_id_GostR3410_2001_CryptoPro_XchB_ParamSet, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2001 CryptoPro-XchB"},
> > -     {NID_id_tc26_gost_3410_2012_512_paramSetA, &_EC_GOST_2012_TC26_A.h, 0, "GOST R 34.10-2012 TC26-A"},
> > -     {NID_id_tc26_gost_3410_2012_512_paramSetB, &_EC_GOST_2012_TC26_B.h, 0, "GOST R 34.10-2012 TC26-B"},
> > +     {NID_id_tc26_gost_3410_2012_256_paramSetA, &_EC_GOST_2012_256_TC26_A.h, 0, "GOST R 34.10-2012 256 TC26-A"},
> > +     {NID_id_tc26_gost_3410_2012_256_paramSetB, &_EC_GOST_2001_CryptoPro_A.h, 0, "GOST R 34.10-2001 512 TC26-B"},
> > +     {NID_id_tc26_gost_3410_2012_256_paramSetC, &_EC_GOST_2001_CryptoPro_B.h, 0, "GOST R 34.10-2001 512 TC26-C"},
> > +     {NID_id_tc26_gost_3410_2012_256_paramSetD, &_EC_GOST_2001_CryptoPro_C.h, 0, "GOST R 34.10-2012 512 TC26-D"},
>
>
> Are the 4th parameter above respectively
> "GOST R 34.10-2012 256 TC26-B" ?
> "GOST R 34.10-2012 256 TC26-C" ?
> "GOST R 34.10-2012 256 TC26-D" ?

Yes. C&P error. Fixing now.

> > +     {NID_id_tc26_gost_3410_2012_512_paramSetTest, &_EC_GOST_2012_512_Test.h, 0, "GOST R 34.10-2012 512 Test Curve"},
> > +     {NID_id_tc26_gost_3410_2012_512_paramSetA, &_EC_GOST_2012_512_TC26_A.h, 0, "GOST R 34.10-2012 512 TC26-A"},
> > +     {NID_id_tc26_gost_3410_2012_512_paramSetB, &_EC_GOST_2012_512_TC26_B.h, 0, "GOST R 34.10-2012 512 TC26-B"},
> > +     {NID_id_tc26_gost_3410_2012_512_paramSetC, &_EC_GOST_2012_512_TC26_C.h, 0, "GOST R 34.10-2012 512 TC26-C"},
> >  #endif
> >  };
> >
> > diff --git a/src/lib/libcrypto/objects/obj_mac.num b/src/lib/libcrypto/objects/obj_mac.num
> > index 8405ba5e319b..a7cfe548d6bd 100644
> > --- a/src/lib/libcrypto/objects/obj_mac.num
> > +++ b/src/lib/libcrypto/objects/obj_mac.num
> > @@ -990,3 +990,9 @@ dhSinglePass_cofactorDH_sha512kdf_scheme  989
> >  dh_std_kdf   990
> >  dh_cofactor_kdf      991
> >  pSpecified   992
> > +id_tc26_gost_3410_2012_256_paramSetA         993
> > +id_tc26_gost_3410_2012_256_paramSetB         994
> > +id_tc26_gost_3410_2012_256_paramSetC         995
> > +id_tc26_gost_3410_2012_256_paramSetD         996
> > +id_tc26_gost_3410_2012_512_paramSetTest              997
> > +id_tc26_gost_3410_2012_512_paramSetC         998
> > diff --git a/src/lib/libcrypto/objects/objects.txt b/src/lib/libcrypto/objects/objects.txt
> > index ea7700724f00..e097c50e696b 100644
> > --- a/src/lib/libcrypto/objects/objects.txt
> > +++ b/src/lib/libcrypto/objects/objects.txt
> > @@ -1372,8 +1372,14 @@ member-body 643 7 1    : tc26
> >  tc26 1 2 2           : streebog256 : GOST R 34.11-2012 (256 bit)
> >  !Cname id-tc26-gost3411-2012-512
> >  tc26 1 2 3           : streebog512 : GOST R 34-11-2012 (512 bit)
> > -tc26 2 1 2 1         : id-tc26-gost-3410-2012-512-paramSetA
> > -tc26 2 1 2 2         : id-tc26-gost-3410-2012-512-paramSetB
> > +tc26 2 1 1 1         : id-tc26-gost-3410-2012-256-paramSetA : GOST R 34.10-2012 (256 bit) ParamSet A
> > +tc26 2 1 1 2         : id-tc26-gost-3410-2012-256-paramSetB : GOST R 34.10-2012 (256 bit) ParamSet B
> > +tc26 2 1 1 3         : id-tc26-gost-3410-2012-256-paramSetC : GOST R 34.10-2012 (256 bit) ParamSet C
> > +tc26 2 1 1 4         : id-tc26-gost-3410-2012-256-paramSetD : GOST R 34.10-2012 (256 bit) ParamSet D
> > +tc26 2 1 2 0         : id-tc26-gost-3410-2012-512-paramSetTest : GOST R 34.10-2012 (512 bit) testing parameter set
> > +tc26 2 1 2 1         : id-tc26-gost-3410-2012-512-paramSetA : GOST R 34.10-2012 (512 bit) ParamSet A
> > +tc26 2 1 2 2         : id-tc26-gost-3410-2012-512-paramSetB : GOST R 34.10-2012 (512 bit) ParamSet B
>
>
> These 2 are added in obj_mac.num and objects.txt (-2012-).
>   id-tc26-gost-3410-2012-512-paramSetA
>   id-tc26-gost-3410-2012-512-paramSetB

These two are already present in LibreSSL's sources, I've just added LNs.
They were added long time ago, when there was discrepancy where -2012-
or -12- should be used.

> But in RFC7836 these 2 parameter set object identifiers are described (-12-),
>   id-tc26-gost-3410-12-512-paramSetA
>   id-tc26-gost-3410-12-512-paramSetB
>
> Is -2012- right ?
> I thought this diff would be right and RFC should be fixed.

I have followed OpenSSL's lead here (they use -2012-). The registry
uses -12- however (see
https://tc26.ru/about/protsedury-i-reglamenty/identifikatory-obektov-oid-tekhnicheskogo-komiteta-po-standartizatsii-kriptograficheskaya-zashchita-1.html).
I'll change all of them to -12-.

> > +tc26 2 1 2 3         : id-tc26-gost-3410-2012-512-paramSetC : GOST R 34.10-2012 (512 bit) ParamSet C
> >  tc26 2 5 1 1         : id-tc26-gost-28147-param-Z
> >  tc26 1 1 1           : id-tc26-gost3410-2012-256 : GOST R 34.10-2012 (256 bit)
> >  tc26 1 1 2           : id-tc26-gost3410-2012-512 : GOST R 34.10-2012 (512 bit)

--
With best wishes
Dmitry