grpc 1.56.2 → 1.58.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec.c

@@ -80,270 +80,147 @@
 #include "../bn/internal.h"
 #include "../delocate.h"
 
+#include "builtin_curves.h"
 
-static void ec_point_free(EC_POINT *point, int free_group);
-
-static const uint8_t kP224Params[6 * 28] = {
-    // p = 2^224 - 2^96 + 1
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x01,
-    // a
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFE,
-    // b
-    0xB4, 0x05, 0x0A, 0x85, 0x0C, 0x04, 0xB3, 0xAB, 0xF5, 0x41, 0x32, 0x56,
-    0x50, 0x44, 0xB0, 0xB7, 0xD7, 0xBF, 0xD8, 0xBA, 0x27, 0x0B, 0x39, 0x43,
-    0x23, 0x55, 0xFF, 0xB4,
-    // x
-    0xB7, 0x0E, 0x0C, 0xBD, 0x6B, 0xB4, 0xBF, 0x7F, 0x32, 0x13, 0x90, 0xB9,
-    0x4A, 0x03, 0xC1, 0xD3, 0x56, 0xC2, 0x11, 0x22, 0x34, 0x32, 0x80, 0xD6,
-    0x11, 0x5C, 0x1D, 0x21,
-    // y
-    0xbd, 0x37, 0x63, 0x88, 0xb5, 0xf7, 0x23, 0xfb, 0x4c, 0x22, 0xdf, 0xe6,
-    0xcd, 0x43, 0x75, 0xa0, 0x5a, 0x07, 0x47, 0x64, 0x44, 0xd5, 0x81, 0x99,
-    0x85, 0x00, 0x7e, 0x34,
-    // order
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0x16, 0xA2, 0xE0, 0xB8, 0xF0, 0x3E, 0x13, 0xDD, 0x29, 0x45,
-    0x5C, 0x5C, 0x2A, 0x3D,
-};
-
-static const uint8_t kP256Params[6 * 32] = {
-    // p = 2^256 - 2^224 + 2^192 + 2^96 - 1
-    0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    // a
-    0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
-    // b
-    0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, 0xB3, 0xEB, 0xBD, 0x55,
-    0x76, 0x98, 0x86, 0xBC, 0x65, 0x1D, 0x06, 0xB0, 0xCC, 0x53, 0xB0, 0xF6,
-    0x3B, 0xCE, 0x3C, 0x3E, 0x27, 0xD2, 0x60, 0x4B,
-    // x
-    0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8, 0xBC, 0xE6, 0xE5,
-    0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D, 0x81, 0x2D, 0xEB, 0x33, 0xA0,
-    0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98, 0xC2, 0x96,
-    // y
-    0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a,
-    0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce,
-    0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
-    // order
-    0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84,
-    0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51,
-};
-
-static const uint8_t kP384Params[6 * 48] = {
-    // p = 2^384 - 2^128 - 2^96 + 2^32 - 1
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
-    // a
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFC,
-    // b
-    0xB3, 0x31, 0x2F, 0xA7, 0xE2, 0x3E, 0xE7, 0xE4, 0x98, 0x8E, 0x05, 0x6B,
-    0xE3, 0xF8, 0x2D, 0x19, 0x18, 0x1D, 0x9C, 0x6E, 0xFE, 0x81, 0x41, 0x12,
-    0x03, 0x14, 0x08, 0x8F, 0x50, 0x13, 0x87, 0x5A, 0xC6, 0x56, 0x39, 0x8D,
-    0x8A, 0x2E, 0xD1, 0x9D, 0x2A, 0x85, 0xC8, 0xED, 0xD3, 0xEC, 0x2A, 0xEF,
-    // x
-    0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05, 0x37, 0x8E, 0xB1, 0xC7, 0x1E,
-    0xF3, 0x20, 0xAD, 0x74, 0x6E, 0x1D, 0x3B, 0x62, 0x8B, 0xA7, 0x9B, 0x98,
-    0x59, 0xF7, 0x41, 0xE0, 0x82, 0x54, 0x2A, 0x38, 0x55, 0x02, 0xF2, 0x5D,
-    0xBF, 0x55, 0x29, 0x6C, 0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A, 0xB7,
-    // y
-    0x36, 0x17, 0xde, 0x4a, 0x96, 0x26, 0x2c, 0x6f, 0x5d, 0x9e, 0x98, 0xbf,
-    0x92, 0x92, 0xdc, 0x29, 0xf8, 0xf4, 0x1d, 0xbd, 0x28, 0x9a, 0x14, 0x7c,
-    0xe9, 0xda, 0x31, 0x13, 0xb5, 0xf0, 0xb8, 0xc0, 0x0a, 0x60, 0xb1, 0xce,
-    0x1d, 0x7e, 0x81, 0x9d, 0x7a, 0x43, 0x1d, 0x7c, 0x90, 0xea, 0x0e, 0x5f,
-    // order
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xC7, 0x63, 0x4D, 0x81, 0xF4, 0x37, 0x2D, 0xDF, 0x58, 0x1A, 0x0D, 0xB2,
-    0x48, 0xB0, 0xA7, 0x7A, 0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73,
-};
-
-static const uint8_t kP521Params[6 * 66] = {
-    // p = 2^521 - 1
-    0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    // a
-    0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
-    // b
-    0x00, 0x51, 0x95, 0x3E, 0xB9, 0x61, 0x8E, 0x1C, 0x9A, 0x1F, 0x92, 0x9A,
-    0x21, 0xA0, 0xB6, 0x85, 0x40, 0xEE, 0xA2, 0xDA, 0x72, 0x5B, 0x99, 0xB3,
-    0x15, 0xF3, 0xB8, 0xB4, 0x89, 0x91, 0x8E, 0xF1, 0x09, 0xE1, 0x56, 0x19,
-    0x39, 0x51, 0xEC, 0x7E, 0x93, 0x7B, 0x16, 0x52, 0xC0, 0xBD, 0x3B, 0xB1,
-    0xBF, 0x07, 0x35, 0x73, 0xDF, 0x88, 0x3D, 0x2C, 0x34, 0xF1, 0xEF, 0x45,
-    0x1F, 0xD4, 0x6B, 0x50, 0x3F, 0x00,
-    // x
-    0x00, 0xC6, 0x85, 0x8E, 0x06, 0xB7, 0x04, 0x04, 0xE9, 0xCD, 0x9E, 0x3E,
-    0xCB, 0x66, 0x23, 0x95, 0xB4, 0x42, 0x9C, 0x64, 0x81, 0x39, 0x05, 0x3F,
-    0xB5, 0x21, 0xF8, 0x28, 0xAF, 0x60, 0x6B, 0x4D, 0x3D, 0xBA, 0xA1, 0x4B,
-    0x5E, 0x77, 0xEF, 0xE7, 0x59, 0x28, 0xFE, 0x1D, 0xC1, 0x27, 0xA2, 0xFF,
-    0xA8, 0xDE, 0x33, 0x48, 0xB3, 0xC1, 0x85, 0x6A, 0x42, 0x9B, 0xF9, 0x7E,
-    0x7E, 0x31, 0xC2, 0xE5, 0xBD, 0x66,
-    // y
-    0x01, 0x18, 0x39, 0x29, 0x6a, 0x78, 0x9a, 0x3b, 0xc0, 0x04, 0x5c, 0x8a,
-    0x5f, 0xb4, 0x2c, 0x7d, 0x1b, 0xd9, 0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b,
-    0x44, 0x68, 0x17, 0xaf, 0xbd, 0x17, 0x27, 0x3e, 0x66, 0x2c, 0x97, 0xee,
-    0x72, 0x99, 0x5e, 0xf4, 0x26, 0x40, 0xc5, 0x50, 0xb9, 0x01, 0x3f, 0xad,
-    0x07, 0x61, 0x35, 0x3c, 0x70, 0x86, 0xa2, 0x72, 0xc2, 0x40, 0x88, 0xbe,
-    0x94, 0x76, 0x9f, 0xd1, 0x66, 0x50,
-    // order
-    0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFA, 0x51, 0x86,
-    0x87, 0x83, 0xBF, 0x2F, 0x96, 0x6B, 0x7F, 0xCC, 0x01, 0x48, 0xF7, 0x09,
-    0xA5, 0xD0, 0x3B, 0xB5, 0xC9, 0xB8, 0x89, 0x9C, 0x47, 0xAE, 0xBB, 0x6F,
-    0xB7, 0x1E, 0x91, 0x38, 0x64, 0x09,
-};
-
-DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
-  // 1.3.132.0.35
-  static const uint8_t kOIDP521[] = {0x2b, 0x81, 0x04, 0x00, 0x23};
-  out->curves[0].nid = NID_secp521r1;
-  out->curves[0].oid = kOIDP521;
-  out->curves[0].oid_len = sizeof(kOIDP521);
-  out->curves[0].comment = "NIST P-521";
-  out->curves[0].param_len = 66;
-  out->curves[0].params = kP521Params;
-  out->curves[0].method = EC_GFp_mont_method();
 
-  // 1.3.132.0.34
-  static const uint8_t kOIDP384[] = {0x2b, 0x81, 0x04, 0x00, 0x22};
-  out->curves[1].nid = NID_secp384r1;
-  out->curves[1].oid = kOIDP384;
-  out->curves[1].oid_len = sizeof(kOIDP384);
-  out->curves[1].comment = "NIST P-384";
-  out->curves[1].param_len = 48;
-  out->curves[1].params = kP384Params;
-  out->curves[1].method = EC_GFp_mont_method();
+static void ec_point_free(EC_POINT *point, int free_group);
 
-  // 1.2.840.10045.3.1.7
-  static const uint8_t kOIDP256[] = {0x2a, 0x86, 0x48, 0xce,
-                                     0x3d, 0x03, 0x01, 0x07};
-  out->curves[2].nid = NID_X9_62_prime256v1;
-  out->curves[2].oid = kOIDP256;
-  out->curves[2].oid_len = sizeof(kOIDP256);
-  out->curves[2].comment = "NIST P-256";
-  out->curves[2].param_len = 32;
-  out->curves[2].params = kP256Params;
-  out->curves[2].method =
-#if !defined(OPENSSL_NO_ASM) && \
-    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&   \
-    !defined(OPENSSL_SMALL)
-      EC_GFp_nistz256_method();
+static void ec_group_init_static_mont(BN_MONT_CTX *mont, size_t num_words,
+                                      const BN_ULONG *modulus,
+                                      const BN_ULONG *rr, uint64_t n0) {
+  bn_set_static_words(&mont->N, modulus, num_words);
+  bn_set_static_words(&mont->RR, rr, num_words);
+#if defined(OPENSSL_64_BIT)
+  mont->n0[0] = n0;
+#elif defined(OPENSSL_32_BIT)
+  mont->n0[0] = (uint32_t)n0;
+  mont->n0[1] = (uint32_t)(n0 >> 32);
 #else
-      EC_GFp_nistp256_method();
+#error "unknown word length"
 #endif
+}
 
+static void ec_group_set_a_minus3(EC_GROUP *group) {
+  const EC_FELEM *one = ec_felem_one(group);
+  group->a_is_minus3 = 1;
+  ec_felem_neg(group, &group->a, one);
+  ec_felem_sub(group, &group->a, &group->a, one);
+  ec_felem_sub(group, &group->a, &group->a, one);
+}
+
+DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p224) {
+  out->curve_name = NID_secp224r1;
+  out->comment = "NIST P-224";
   // 1.3.132.0.33
   static const uint8_t kOIDP224[] = {0x2b, 0x81, 0x04, 0x00, 0x21};
-  out->curves[3].nid = NID_secp224r1;
-  out->curves[3].oid = kOIDP224;
-  out->curves[3].oid_len = sizeof(kOIDP224);
-  out->curves[3].comment = "NIST P-224";
-  out->curves[3].param_len = 28;
-  out->curves[3].params = kP224Params;
-  out->curves[3].method =
+  OPENSSL_memcpy(out->oid, kOIDP224, sizeof(kOIDP224));
+  out->oid_len = sizeof(kOIDP224);
+
+  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP224Field),
+                            kP224Field, kP224FieldRR, kP224FieldN0);
+  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP224Order),
+                            kP224Order, kP224OrderRR, kP224OrderN0);
+
 #if defined(BORINGSSL_HAS_UINT128) && !defined(OPENSSL_SMALL)
-      EC_GFp_nistp224_method();
+  out->meth = EC_GFp_nistp224_method();
+  OPENSSL_memcpy(out->generator.raw.X.words, kP224GX, sizeof(kP224GX));
+  OPENSSL_memcpy(out->generator.raw.Y.words, kP224GY, sizeof(kP224GY));
+  out->generator.raw.Z.words[0] = 1;
+  OPENSSL_memcpy(out->b.words, kP224B, sizeof(kP224B));
 #else
-      EC_GFp_mont_method();
+  out->meth = EC_GFp_mont_method();
+  OPENSSL_memcpy(out->generator.raw.X.words, kP224MontGX, sizeof(kP224MontGX));
+  OPENSSL_memcpy(out->generator.raw.Y.words, kP224MontGY, sizeof(kP224MontGY));
+  OPENSSL_memcpy(out->generator.raw.Z.words, kP224FieldR, sizeof(kP224FieldR));
+  OPENSSL_memcpy(out->b.words, kP224MontB, sizeof(kP224MontB));
 #endif
-}
-
-EC_GROUP *ec_group_new(const EC_METHOD *meth) {
-  EC_GROUP *ret;
-
-  if (meth == NULL) {
-    OPENSSL_PUT_ERROR(EC, EC_R_SLOT_FULL);
-    return NULL;
-  }
-
-  if (meth->group_init == 0) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    return NULL;
-  }
-
-  ret = OPENSSL_malloc(sizeof(EC_GROUP));
-  if (ret == NULL) {
-    return NULL;
-  }
-  OPENSSL_memset(ret, 0, sizeof(EC_GROUP));
+  out->generator.group = out;
 
-  ret->references = 1;
-  ret->meth = meth;
-  BN_init(&ret->order);
-
-  if (!meth->group_init(ret)) {
-    OPENSSL_free(ret);
-    return NULL;
-  }
-
-  return ret;
+  ec_group_set_a_minus3(out);
+  out->has_order = 1;
+  out->field_greater_than_order = 1;
 }
 
-static int ec_group_set_generator(EC_GROUP *group, const EC_AFFINE *generator,
-                                  const BIGNUM *order) {
-  assert(group->generator == NULL);
-
-  if (!BN_copy(&group->order, order)) {
-    return 0;
-  }
-  // Store the order in minimal form, so it can be used with |BN_ULONG| arrays.
-  bn_set_minimal_width(&group->order);
+DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p256) {
+  out->curve_name = NID_X9_62_prime256v1;
+  out->comment = "NIST P-256";
+  // 1.2.840.10045.3.1.7
+  static const uint8_t kOIDP256[] = {0x2a, 0x86, 0x48, 0xce,
+                                     0x3d, 0x03, 0x01, 0x07};
+  OPENSSL_memcpy(out->oid, kOIDP256, sizeof(kOIDP256));
+  out->oid_len = sizeof(kOIDP256);
 
-  BN_MONT_CTX_free(group->order_mont);
-  group->order_mont = BN_MONT_CTX_new_for_modulus(&group->order, NULL);
-  if (group->order_mont == NULL) {
-    return 0;
-  }
+  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP256Field),
+                            kP256Field, kP256FieldRR, kP256FieldN0);
+  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP256Order),
+                            kP256Order, kP256OrderRR, kP256OrderN0);
 
-  group->field_greater_than_order = BN_cmp(&group->field, order) > 0;
-  if (group->field_greater_than_order) {
-    BIGNUM tmp;
-    BN_init(&tmp);
-    int ok =
-        BN_sub(&tmp, &group->field, order) &&
-        bn_copy_words(group->field_minus_order.words, group->field.width, &tmp);
-    BN_free(&tmp);
-    if (!ok) {
-      return 0;
-    }
-  }
-
-  group->generator = EC_POINT_new(group);
-  if (group->generator == NULL) {
-    return 0;
-  }
-  ec_affine_to_jacobian(group, &group->generator->raw, generator);
-  assert(ec_felem_equal(group, &group->one, &group->generator->raw.Z));
+#if !defined(OPENSSL_NO_ASM) &&                              \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
+    !defined(OPENSSL_SMALL)
+  out->meth = EC_GFp_nistz256_method();
+#else
+  out->meth = EC_GFp_nistp256_method();
+#endif
+  out->generator.group = out;
+  OPENSSL_memcpy(out->generator.raw.X.words, kP256MontGX, sizeof(kP256MontGX));
+  OPENSSL_memcpy(out->generator.raw.Y.words, kP256MontGY, sizeof(kP256MontGY));
+  OPENSSL_memcpy(out->generator.raw.Z.words, kP256FieldR, sizeof(kP256FieldR));
+  OPENSSL_memcpy(out->b.words, kP256MontB, sizeof(kP256MontB));
+
+  ec_group_set_a_minus3(out);
+  out->has_order = 1;
+  out->field_greater_than_order = 1;
+}
 
-  // Avoid a reference cycle. |group->generator| does not maintain an owning
-  // pointer to |group|.
-  int is_zero = CRYPTO_refcount_dec_and_test_zero(&group->references);
+DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p384) {
+  out->curve_name = NID_secp384r1;
+  out->comment = "NIST P-384";
+  // 1.3.132.0.34
+  static const uint8_t kOIDP384[] = {0x2b, 0x81, 0x04, 0x00, 0x22};
+  OPENSSL_memcpy(out->oid, kOIDP384, sizeof(kOIDP384));
+  out->oid_len = sizeof(kOIDP384);
+
+  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP384Field),
+                            kP384Field, kP384FieldRR, kP384FieldN0);
+  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP384Order),
+                            kP384Order, kP384OrderRR, kP384OrderN0);
+
+  out->meth = EC_GFp_mont_method();
+  out->generator.group = out;
+  OPENSSL_memcpy(out->generator.raw.X.words, kP384MontGX, sizeof(kP384MontGX));
+  OPENSSL_memcpy(out->generator.raw.Y.words, kP384MontGY, sizeof(kP384MontGY));
+  OPENSSL_memcpy(out->generator.raw.Z.words, kP384FieldR, sizeof(kP384FieldR));
+  OPENSSL_memcpy(out->b.words, kP384MontB, sizeof(kP384MontB));
+
+  ec_group_set_a_minus3(out);
+  out->has_order = 1;
+  out->field_greater_than_order = 1;
+}
 
-  assert(!is_zero);
-  (void)is_zero;
-  return 1;
+DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p521) {
+  out->curve_name = NID_secp521r1;
+  out->comment = "NIST P-521";
+  // 1.3.132.0.35
+  static const uint8_t kOIDP521[] = {0x2b, 0x81, 0x04, 0x00, 0x23};
+  OPENSSL_memcpy(out->oid, kOIDP521, sizeof(kOIDP521));
+  out->oid_len = sizeof(kOIDP521);
+
+  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP521Field),
+                            kP521Field, kP521FieldRR, kP521FieldN0);
+  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP521Order),
+                            kP521Order, kP521OrderRR, kP521OrderN0);
+
+  out->meth = EC_GFp_mont_method();
+  out->generator.group = out;
+  OPENSSL_memcpy(out->generator.raw.X.words, kP521MontGX, sizeof(kP521MontGX));
+  OPENSSL_memcpy(out->generator.raw.Y.words, kP521MontGY, sizeof(kP521MontGY));
+  OPENSSL_memcpy(out->generator.raw.Z.words, kP521FieldR, sizeof(kP521FieldR));
+  OPENSSL_memcpy(out->b.words, kP521MontB, sizeof(kP521MontB));
+
+  ec_group_set_a_minus3(out);
+  out->has_order = 1;
+  out->field_greater_than_order = 1;
 }
 
 EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
@@ -373,9 +250,17 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
     goto err;
   }
 
-  ret = ec_group_new(EC_GFp_mont_method());
-  if (ret == NULL ||
-      !ret->meth->group_set_curve(ret, p, a_reduced, b_reduced, ctx)) {
+  ret = OPENSSL_malloc(sizeof(EC_GROUP));
+  if (ret == NULL) {
+    return NULL;
+  }
+  OPENSSL_memset(ret, 0, sizeof(EC_GROUP));
+  ret->references = 1;
+  ret->meth = EC_GFp_mont_method();
+  bn_mont_ctx_init(&ret->field);
+  bn_mont_ctx_init(&ret->order);
+  ret->generator.group = ret;
+  if (!ec_GFp_simple_group_set_curve(ret, p, a_reduced, b_reduced, ctx)) {
     EC_GROUP_free(ret);
     ret = NULL;
     goto err;
@@ -389,7 +274,7 @@ err:
 
 int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
                            const BIGNUM *order, const BIGNUM *cofactor) {
-  if (group->curve_name != NID_undef || group->generator != NULL ||
+  if (group->curve_name != NID_undef || group->has_order ||
       generator->group != group) {
     // |EC_GROUP_set_generator| may only be used with |EC_GROUP|s returned by
     // |EC_GROUP_new_curve_GFp| and may only used once on each group.
@@ -421,17 +306,22 @@ int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
       !BN_lshift1(tmp, order)) {
     goto err;
   }
-  if (BN_cmp(tmp, &group->field) <= 0) {
+  if (BN_cmp(tmp, &group->field.N) <= 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER);
     goto err;
   }
 
   EC_AFFINE affine;
   if (!ec_jacobian_to_affine(group, &affine, &generator->raw) ||
-      !ec_group_set_generator(group, &affine, order)) {
+      !BN_MONT_CTX_set(&group->order, order, NULL)) {
     goto err;
   }
 
+  group->field_greater_than_order = BN_cmp(&group->field.N, order) > 0;
+  group->generator.raw.X = affine.X;
+  group->generator.raw.Y = affine.Y;
+  // |raw.Z| was set to 1 by |EC_GROUP_new_curve_GFp|.
+  group->has_order = 1;
   ret = 1;
 
 err:
@@ -439,114 +329,20 @@ err:
   return ret;
 }
 
-static EC_GROUP *ec_group_new_from_data(const struct built_in_curve *curve) {
-  EC_GROUP *group = NULL;
-  BIGNUM *p = NULL, *a = NULL, *b = NULL, *order = NULL;
-  int ok = 0;
-
-  BN_CTX *ctx = BN_CTX_new();
-  if (ctx == NULL) {
-    goto err;
-  }
-
-  const unsigned param_len = curve->param_len;
-  const uint8_t *params = curve->params;
-
-  if (!(p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) ||
-      !(a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) ||
-      !(b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) ||
-      !(order = BN_bin2bn(params + 5 * param_len, param_len, NULL))) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB);
-    goto err;
-  }
-
-  group = ec_group_new(curve->method);
-  if (group == NULL ||
-      !group->meth->group_set_curve(group, p, a, b, ctx)) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB);
-    goto err;
-  }
-
-  EC_AFFINE G;
-  EC_FELEM x, y;
-  if (!ec_felem_from_bytes(group, &x, params + 3 * param_len, param_len) ||
-      !ec_felem_from_bytes(group, &y, params + 4 * param_len, param_len) ||
-      !ec_point_set_affine_coordinates(group, &G, &x, &y)) {
-    goto err;
-  }
-
-  if (!ec_group_set_generator(group, &G, order)) {
-    goto err;
-  }
-
-  ok = 1;
-
-err:
-  if (!ok) {
-    EC_GROUP_free(group);
-    group = NULL;
-  }
-  BN_CTX_free(ctx);
-  BN_free(p);
-  BN_free(a);
-  BN_free(b);
-  BN_free(order);
-  return group;
-}
-
-// Built-in groups are allocated lazily and static once allocated.
-// TODO(davidben): Make these actually static. https://crbug.com/boringssl/20.
-struct built_in_groups_st {
-  EC_GROUP *groups[OPENSSL_NUM_BUILT_IN_CURVES];
-};
-DEFINE_BSS_GET(struct built_in_groups_st, built_in_groups)
-DEFINE_STATIC_MUTEX(built_in_groups_lock)
-
 EC_GROUP *EC_GROUP_new_by_curve_name(int nid) {
-  struct built_in_groups_st *groups = built_in_groups_bss_get();
-  EC_GROUP **group_ptr = NULL;
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  const struct built_in_curve *curve = NULL;
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    if (curves->curves[i].nid == nid) {
-      curve = &curves->curves[i];
-      group_ptr = &groups->groups[i];
-      break;
-    }
-  }
-
-  if (curve == NULL) {
-    OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-    return NULL;
-  }
-
-  CRYPTO_STATIC_MUTEX_lock_read(built_in_groups_lock_bss_get());
-  EC_GROUP *ret = *group_ptr;
-  CRYPTO_STATIC_MUTEX_unlock_read(built_in_groups_lock_bss_get());
-  if (ret != NULL) {
-    return ret;
-  }
-
-  ret = ec_group_new_from_data(curve);
-  if (ret == NULL) {
-    return NULL;
-  }
-
-  EC_GROUP *to_free = NULL;
-  CRYPTO_STATIC_MUTEX_lock_write(built_in_groups_lock_bss_get());
-  if (*group_ptr == NULL) {
-    *group_ptr = ret;
-    // Filling in |ret->curve_name| makes |EC_GROUP_free| and |EC_GROUP_dup|
-    // into no-ops. At this point, |ret| is considered static.
-    ret->curve_name = nid;
-  } else {
-    to_free = ret;
-    ret = *group_ptr;
+  switch (nid) {
+    case NID_secp224r1:
+      return (EC_GROUP *)EC_group_p224();
+    case NID_X9_62_prime256v1:
+      return (EC_GROUP *)EC_group_p256();
+    case NID_secp384r1:
+      return (EC_GROUP *)EC_group_p384();
+    case NID_secp521r1:
+      return (EC_GROUP *)EC_group_p521();
+    default:
+      OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
+      return NULL;
   }
-  CRYPTO_STATIC_MUTEX_unlock_write(built_in_groups_lock_bss_get());
-
-  EC_GROUP_free(to_free);
-  return ret;
 }
 
 void EC_GROUP_free(EC_GROUP *group) {
@@ -557,14 +353,8 @@ void EC_GROUP_free(EC_GROUP *group) {
     return;
   }
 
-  if (group->meth->group_finish != NULL) {
-    group->meth->group_finish(group);
-  }
-
-  ec_point_free(group->generator, 0 /* don't free group */);
-  BN_free(&group->order);
-  BN_MONT_CTX_free(group->order_mont);
-
+  bn_mont_ctx_cleanup(&group->order);
+  bn_mont_ctx_cleanup(&group->field);
   OPENSSL_free(group);
 }
 
@@ -599,23 +389,22 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) {
   // structure. If |a| or |b| is incomplete (due to legacy OpenSSL mistakes,
   // custom curve construction is sadly done in two parts) but otherwise not the
   // same object, we consider them always unequal.
-  return a->meth != b->meth ||
-         a->generator == NULL ||
-         b->generator == NULL ||
-         BN_cmp(&a->order, &b->order) != 0 ||
-         BN_cmp(&a->field, &b->field) != 0 ||
-         !ec_felem_equal(a, &a->a, &b->a) ||
+  return a->meth != b->meth ||  //
+         !a->has_order || !b->has_order ||
+         BN_cmp(&a->order.N, &b->order.N) != 0 ||
+         BN_cmp(&a->field.N, &b->field.N) != 0 ||
+         !ec_felem_equal(a, &a->a, &b->a) ||  //
          !ec_felem_equal(a, &a->b, &b->b) ||
-         !ec_GFp_simple_points_equal(a, &a->generator->raw, &b->generator->raw);
+         !ec_GFp_simple_points_equal(a, &a->generator.raw, &b->generator.raw);
 }
 
 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group) {
-  return group->generator;
+  return group->has_order ? &group->generator : NULL;
 }
 
 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) {
-  assert(!BN_is_zero(&group->order));
-  return &group->order;
+  assert(group->has_order);
+  return &group->order.N;
 }
 
 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) {
@@ -626,7 +415,7 @@ int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) {
 }
 
 int EC_GROUP_order_bits(const EC_GROUP *group) {
-  return BN_num_bits(&group->order);
+  return BN_num_bits(&group->order.N);
 }
 
 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
@@ -643,7 +432,7 @@ int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *out_p, BIGNUM *out_a,
 int EC_GROUP_get_curve_name(const EC_GROUP *group) { return group->curve_name; }
 
 unsigned EC_GROUP_get_degree(const EC_GROUP *group) {
-  return BN_num_bits(&group->field);
+  return BN_num_bits(&group->field.N);
 }
 
 const char *EC_curve_nid2nist(int nid) {
@@ -805,7 +594,7 @@ void ec_affine_to_jacobian(const EC_GROUP *group, EC_JACOBIAN *out,
                            const EC_AFFINE *p) {
   out->X = p->X;
   out->Y = p->Y;
-  out->Z = group->one;
+  out->Z = *ec_felem_one(group);
 }
 
 int ec_jacobian_to_affine(const EC_GROUP *group, EC_AFFINE *out,
@@ -842,10 +631,9 @@ int ec_point_set_affine_coordinates(const EC_GROUP *group, EC_AFFINE *out,
     // return value by setting a known safe value. Note this may not be possible
     // if the caller is in the process of constructing an arbitrary group and
     // the generator is missing.
-    if (group->generator != NULL) {
-      assert(ec_felem_equal(group, &group->one, &group->generator->raw.Z));
-      out->X = group->generator->raw.X;
-      out->Y = group->generator->raw.Y;
+    if (group->has_order) {
+      out->X = group->generator.raw.X;
+      out->Y = group->generator.raw.Y;
     }
     return 0;
   }
@@ -931,11 +719,10 @@ static int arbitrary_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   ERR_clear_error();
 
   // This is an unusual input, so we do not guarantee constant-time processing.
-  const BIGNUM *order = &group->order;
   BN_CTX_start(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   int ok = tmp != NULL &&
-           BN_nnmod(tmp, in, order, ctx) &&
+           BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) &&
            ec_bignum_to_scalar(group, out, tmp);
   BN_CTX_end(ctx);
   return ok;
@@ -1074,8 +861,10 @@ int ec_point_mul_scalar_base(const EC_GROUP *group, EC_JACOBIAN *r,
   group->meth->mul_base(group, r, scalar);
 
   // Check the result is on the curve to defend against fault attacks or bugs.
-  // This has negligible cost compared to the multiplication.
-  if (!ec_GFp_simple_is_on_curve(group, r)) {
+  // This has negligible cost compared to the multiplication. This can only
+  // happen on bug or CPU fault, so it okay to leak this. The alternative would
+  // be to proceed with bad data.
+  if (!constant_time_declassify_int(ec_GFp_simple_is_on_curve(group, r))) {
     OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
     return 0;
   }
@@ -1191,7 +980,7 @@ int ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
   //
   // Additionally, one can manually check this property for built-in curves. It
   // is enforced for legacy custom curves in |EC_GROUP_set_generator|.
-  const BIGNUM *order = &group->order;
+  const BIGNUM *order = EC_GROUP_get0_order(group);
   BN_ULONG words[EC_MAX_WORDS + 1] = {0};
   bn_big_endian_to_words(words, order->width + 1, bytes, len);
   bn_reduce_once(out->words, words, /*carry=*/words[order->width], order->d,
@@ -1202,7 +991,7 @@ int ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
 int ec_get_x_coordinate_as_bytes(const EC_GROUP *group, uint8_t *out,
                                  size_t *out_len, size_t max_out,
                                  const EC_JACOBIAN *p) {
-  size_t len = BN_num_bytes(&group->field);
+  size_t len = BN_num_bytes(&group->field.N);
   assert(len <= EC_MAX_BYTES);
   if (max_out < len) {
     OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
@@ -1220,8 +1009,8 @@ int ec_get_x_coordinate_as_bytes(const EC_GROUP *group, uint8_t *out,
 }
 
 void ec_set_to_safe_point(const EC_GROUP *group, EC_JACOBIAN *out) {
-  if (group->generator != NULL) {
-    ec_GFp_simple_point_copy(out, &group->generator->raw);
+  if (group->has_order) {
+    ec_GFp_simple_point_copy(out, &group->generator.raw);
   } else {
     // The generator can be missing if the caller is in the process of
     // constructing an arbitrary group. In this case, we give up and use the
@@ -1253,16 +1042,3 @@ void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
     abort();
   }
 }
-
-size_t EC_get_builtin_curves(EC_builtin_curve *out_curves,
-                             size_t max_num_curves) {
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-
-  for (size_t i = 0; i < max_num_curves && i < OPENSSL_NUM_BUILT_IN_CURVES;
-       i++) {
-    out_curves[i].comment = curves->curves[i].comment;
-    out_curves[i].nid = curves->curves[i].nid;
-  }
-
-  return OPENSSL_NUM_BUILT_IN_CURVES;
-}