crypto: add simple P224 implementation.

crypto/p224.h

+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CRYPTO_P224_H_
+#define CRYPTO_P224_H_
+#pragma once
+
+#include "base/basictypes.h"
+
+namespace crypto {
+
+// P224 implements an elliptic curve group, commonly known as P224 and defined
+// in FIPS 186-3, section D.2.2.
+class P224 {
+ public:
+  struct ExternalPoint {
+    // The external point representation is an (x, y) pair of a point on the
+    // curve. Each field element is represented as a big-endian number < p.
+    uint8 affine[2 * 28];
+  };
+
+  // An element of the field (ℤ/pℤ) is represented with 8, 28-bit limbs in
+  // little endian order.
+  typedef uint32 FieldElement[8];
+
+  struct InternalPoint {
+    // An InternalPoint is represented in Jacobian form (x/z², y/z³).
+    FieldElement x, y, z;
+  };
+
+  // ToInternal converts a point from external to internal representation. It
+  // verifies that the external point actually lies of the curve and returns
+  // true if so.
+  static bool ToInternal(const ExternalPoint& in, InternalPoint* out);

[Wez, 2011/11/02 23:46:06]

Why is this a member of P224, rather than of P224::ExternalPoint?

[agl, 2011/11/03 17:20:49]

I'm not sure that I like it, but meh. Have changed.

+
+  // ToExternal converts an internal point to an external point.
+  static void ToExternal(const InternalPoint& in, ExternalPoint* out);

[Wez, 2011/11/02 23:46:06]

Similarly here.

[agl, 2011/11/03 17:20:49]

Done.

+
+  // ScalarMult computes *out = in*scalar where scalar is a big-endian number.

[Wez, 2011/11/02 23:46:06]

What format is |scalar| in, besides being big-endian?

[agl, 2011/11/03 17:20:49]

None. It's just a big-endian number.

[Wez, 2011/11/03 20:03:46]

But it has to be 224 bits == 28 bytes of big-endian number, doesn't it?

[agl, 2011/11/04 20:13:22]

Oh, I see. Actually no, it could be shorter but since I don't have a length
parameter, yes, it must be 28 bytes. Have updated comment.

+  static void ScalarMult(const InternalPoint& in, const uint8* scalar,
+                         InternalPoint* out);

[Wez, 2011/11/02 23:46:06]

According to style, this should be MultiplyByScalar().
Why is it a member of P224, rather than of P224::InternalPoint?

[agl, 2011/11/03 17:20:49]

ScalarMult is a name taken from EBATS: a standard API for these sort of the
things. MultiplyByScalar would make more sense if it were a member of
P224::InternalPoint, but the field operation is called a scalar multiply.
That strikes me as excessive OOP.

[Wez, 2011/11/03 20:03:46]

OK, I wondered if that might be the case.  I think that trumps the style guide.
:)
I think the issue is that right now P224 is effectively a namespace, not a
class.

Have you considered moving InternalPoint *into* P224, so that each P224 instance
*is* an point in internal representation?  Then the methods live in the class
they operate on, and there is less type-name boilerplate for callers.

+
+  // ScalarBaseMult computes *out = g*scalar where g is the base point of the
+  // curve.
+  static void ScalarBaseMult(const uint8* scalar, InternalPoint* out);
+
+  // Add computes *out = a+b.
+  static void Add(const InternalPoint& a, const InternalPoint& b,
+                  InternalPoint* out);
+
+  // Negate calculates out = -a;
+  static void Negate(const InternalPoint& a, InternalPoint* out);
+};
+
+}  // namespace crypto
+
+#endif  // CRYPTO_P224_H_