grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/ec_montgomery.cc.inc

@@ -24,18 +24,7 @@
 #include "internal.h"
 
 
-static void ec_GFp_mont_felem_to_montgomery(const EC_GROUP *group,
-                                            EC_FELEM *out, const EC_FELEM *in) {
-  bn_to_montgomery_small(out->words, in->words, group->field.N.width,
-                         &group->field);
-}
-
-static void ec_GFp_mont_felem_from_montgomery(const EC_GROUP *group,
-                                              EC_FELEM *out,
-                                              const EC_FELEM *in) {
-  bn_from_montgomery_small(out->words, group->field.N.width, in->words,
-                           group->field.N.width, &group->field);
-}
+using namespace bssl;
 
 static void ec_GFp_mont_felem_inv0(const EC_GROUP *group, EC_FELEM *out,
                                    const EC_FELEM *a) {
@@ -43,53 +32,6 @@ static void ec_GFp_mont_felem_inv0(const EC_GROUP *group, EC_FELEM *out,
                                    &group->field);
 }
 
-void ec_GFp_mont_felem_mul(const EC_GROUP *group, EC_FELEM *r,
-                           const EC_FELEM *a, const EC_FELEM *b) {
-  bn_mod_mul_montgomery_small(r->words, a->words, b->words,
-                              group->field.N.width, &group->field);
-}
-
-void ec_GFp_mont_felem_sqr(const EC_GROUP *group, EC_FELEM *r,
-                           const EC_FELEM *a) {
-  bn_mod_mul_montgomery_small(r->words, a->words, a->words,
-                              group->field.N.width, &group->field);
-}
-
-void ec_GFp_mont_felem_to_bytes(const EC_GROUP *group, uint8_t *out,
-                                size_t *out_len, const EC_FELEM *in) {
-  EC_FELEM tmp;
-  ec_GFp_mont_felem_from_montgomery(group, &tmp, in);
-  ec_GFp_simple_felem_to_bytes(group, out, out_len, &tmp);
-}
-
-int ec_GFp_mont_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out,
-                                 const uint8_t *in, size_t len) {
-  if (!ec_GFp_simple_felem_from_bytes(group, out, in, len)) {
-    return 0;
-  }
-
-  ec_GFp_mont_felem_to_montgomery(group, out, out);
-  return 1;
-}
-
-void ec_GFp_mont_felem_reduce(const EC_GROUP *group, EC_FELEM *out,
-                              const BN_ULONG *words, size_t num) {
-  // Convert "from" Montgomery form so the value is reduced mod p.
-  bn_from_montgomery_small(out->words, group->field.N.width, words, num,
-                           &group->field);
-  // Convert "to" Montgomery form to remove the R^-1 factor added.
-  ec_GFp_mont_felem_to_montgomery(group, out, out);
-  // Convert to Montgomery form to match this implementation's representation.
-  ec_GFp_mont_felem_to_montgomery(group, out, out);
-}
-
-void ec_GFp_mont_felem_exp(const EC_GROUP *group, EC_FELEM *out,
-                           const EC_FELEM *a, const BN_ULONG *exp,
-                           size_t num_exp) {
-  bn_mod_exp_mont_small(out->words, a->words, group->field.N.width, exp,
-                        num_exp, &group->field);
-}
-
 static int ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP *group,
                                                     const EC_JACOBIAN *point,
                                                     EC_FELEM *x, EC_FELEM *y) {
@@ -100,18 +42,18 @@ static int ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP *group,
   }
 
   // Transform (X, Y, Z) into (x, y) := (X/Z^2, Y/Z^3). Note the check above
-  // ensures |point->Z| is non-zero, so the inverse always exists.
+  // ensures `point->Z` is non-zero, so the inverse always exists.
   EC_FELEM z1, z2;
   ec_GFp_mont_felem_inv0(group, &z2, &point->Z);
-  ec_GFp_mont_felem_sqr(group, &z1, &z2);
+  ec_felem_sqr(group, &z1, &z2);
 
-  if (x != NULL) {
-    ec_GFp_mont_felem_mul(group, x, &point->X, &z1);
+  if (x != nullptr) {
+    ec_felem_mul(group, x, &point->X, &z1);
   }
 
-  if (y != NULL) {
-    ec_GFp_mont_felem_mul(group, &z1, &z1, &z2);
-    ec_GFp_mont_felem_mul(group, y, &point->Y, &z1);
+  if (y != nullptr) {
+    ec_felem_mul(group, &z1, &z1, &z2);
+    ec_felem_mul(group, y, &point->Y, &z1);
   }
 
   return 1;
@@ -125,11 +67,11 @@ static int ec_GFp_mont_jacobian_to_affine_batch(const EC_GROUP *group,
     return 1;
   }
 
-  // Compute prefix products of all Zs. Use |out[i].X| as scratch space
+  // Compute prefix products of all Zs. Use `out[i].X` as scratch space
   // to store these values.
   out[0].X = in[0].Z;
   for (size_t i = 1; i < num; i++) {
-    ec_GFp_mont_felem_mul(group, &out[i].X, &out[i - 1].X, &in[i].Z);
+    ec_felem_mul(group, &out[i].X, &out[i - 1].X, &in[i].Z);
   }
 
   // Some input was infinity iff the product of all Zs is zero.
@@ -142,29 +84,29 @@ static int ec_GFp_mont_jacobian_to_affine_batch(const EC_GROUP *group,
   EC_FELEM zinvprod;
   ec_GFp_mont_felem_inv0(group, &zinvprod, &out[num - 1].X);
   for (size_t i = num - 1; i < num; i--) {
-    // Our loop invariant is that |zinvprod| is Z0^-1 * Z1^-1 * ... * Zi^-1.
+    // Our loop invariant is that `zinvprod` is Z0^-1 * Z1^-1 * ... * Zi^-1.
     // Recover Zi^-1 by multiplying by the previous product.
     EC_FELEM zinv, zinv2;
     if (i == 0) {
       zinv = zinvprod;
     } else {
-      ec_GFp_mont_felem_mul(group, &zinv, &zinvprod, &out[i - 1].X);
+      ec_felem_mul(group, &zinv, &zinvprod, &out[i - 1].X);
       // Maintain the loop invariant for the next iteration.
-      ec_GFp_mont_felem_mul(group, &zinvprod, &zinvprod, &in[i].Z);
+      ec_felem_mul(group, &zinvprod, &zinvprod, &in[i].Z);
     }
 
     // Compute affine coordinates: x = X * Z^-2 and y = Y * Z^-3.
-    ec_GFp_mont_felem_sqr(group, &zinv2, &zinv);
-    ec_GFp_mont_felem_mul(group, &out[i].X, &in[i].X, &zinv2);
-    ec_GFp_mont_felem_mul(group, &out[i].Y, &in[i].Y, &zinv2);
-    ec_GFp_mont_felem_mul(group, &out[i].Y, &out[i].Y, &zinv);
+    ec_felem_sqr(group, &zinv2, &zinv);
+    ec_felem_mul(group, &out[i].X, &in[i].X, &zinv2);
+    ec_felem_mul(group, &out[i].Y, &in[i].Y, &zinv2);
+    ec_felem_mul(group, &out[i].Y, &out[i].Y, &zinv);
   }
 
   return 1;
 }
 
-void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
-                     const EC_JACOBIAN *a, const EC_JACOBIAN *b) {
+void bssl::ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
+                           const EC_JACOBIAN *a, const EC_JACOBIAN *b) {
   if (a == b) {
     ec_GFp_mont_dbl(group, out, a);
     return;
@@ -182,31 +124,31 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
 
   // z1z1 = z1z1 = z1**2
   EC_FELEM z1z1;
-  ec_GFp_mont_felem_sqr(group, &z1z1, &a->Z);
+  ec_felem_sqr(group, &z1z1, &a->Z);
 
   // z2z2 = z2**2
   EC_FELEM z2z2;
-  ec_GFp_mont_felem_sqr(group, &z2z2, &b->Z);
+  ec_felem_sqr(group, &z2z2, &b->Z);
 
   // u1 = x1*z2z2
   EC_FELEM u1;
-  ec_GFp_mont_felem_mul(group, &u1, &a->X, &z2z2);
+  ec_felem_mul(group, &u1, &a->X, &z2z2);
 
   // two_z1z2 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2
   EC_FELEM two_z1z2;
   ec_felem_add(group, &two_z1z2, &a->Z, &b->Z);
-  ec_GFp_mont_felem_sqr(group, &two_z1z2, &two_z1z2);
+  ec_felem_sqr(group, &two_z1z2, &two_z1z2);
   ec_felem_sub(group, &two_z1z2, &two_z1z2, &z1z1);
   ec_felem_sub(group, &two_z1z2, &two_z1z2, &z2z2);
 
   // s1 = y1 * z2**3
   EC_FELEM s1;
-  ec_GFp_mont_felem_mul(group, &s1, &b->Z, &z2z2);
-  ec_GFp_mont_felem_mul(group, &s1, &s1, &a->Y);
+  ec_felem_mul(group, &s1, &b->Z, &z2z2);
+  ec_felem_mul(group, &s1, &s1, &a->Y);
 
   // u2 = x2*z1z1
   EC_FELEM u2;
-  ec_GFp_mont_felem_mul(group, &u2, &b->X, &z1z1);
+  ec_felem_mul(group, &u2, &b->X, &z1z1);
 
   // h = u2 - u1
   EC_FELEM h;
@@ -215,15 +157,15 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
   BN_ULONG xneq = ec_felem_non_zero_mask(group, &h);
 
   // z_out = two_z1z2 * h
-  ec_GFp_mont_felem_mul(group, &z_out, &h, &two_z1z2);
+  ec_felem_mul(group, &z_out, &h, &two_z1z2);
 
   // z1z1z1 = z1 * z1z1
   EC_FELEM z1z1z1;
-  ec_GFp_mont_felem_mul(group, &z1z1z1, &a->Z, &z1z1);
+  ec_felem_mul(group, &z1z1z1, &a->Z, &z1z1);
 
   // s2 = y2 * z1**3
   EC_FELEM s2;
-  ec_GFp_mont_felem_mul(group, &s2, &b->Y, &z1z1z1);
+  ec_felem_mul(group, &s2, &b->Y, &z1z1z1);
 
   // r = (s2 - s1)*2
   EC_FELEM r;
@@ -232,7 +174,7 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
 
   BN_ULONG yneq = ec_felem_non_zero_mask(group, &r);
 
-  // This case will never occur in the constant-time |ec_GFp_mont_mul|.
+  // This case will never occur in the constant-time `ec_GFp_mont_mul`.
   BN_ULONG is_nontrivial_double = ~xneq & ~yneq & z1nz & z2nz;
   if (constant_time_declassify_w(is_nontrivial_double)) {
     ec_GFp_mont_dbl(group, out, a);
@@ -242,27 +184,27 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
   // I = (2h)**2
   EC_FELEM i;
   ec_felem_add(group, &i, &h, &h);
-  ec_GFp_mont_felem_sqr(group, &i, &i);
+  ec_felem_sqr(group, &i, &i);
 
   // J = h * I
   EC_FELEM j;
-  ec_GFp_mont_felem_mul(group, &j, &h, &i);
+  ec_felem_mul(group, &j, &h, &i);
 
   // V = U1 * I
   EC_FELEM v;
-  ec_GFp_mont_felem_mul(group, &v, &u1, &i);
+  ec_felem_mul(group, &v, &u1, &i);
 
   // x_out = r**2 - J - 2V
-  ec_GFp_mont_felem_sqr(group, &x_out, &r);
+  ec_felem_sqr(group, &x_out, &r);
   ec_felem_sub(group, &x_out, &x_out, &j);
   ec_felem_sub(group, &x_out, &x_out, &v);
   ec_felem_sub(group, &x_out, &x_out, &v);
 
   // y_out = r(V-x_out) - 2 * s1 * J
   ec_felem_sub(group, &y_out, &v, &x_out);
-  ec_GFp_mont_felem_mul(group, &y_out, &y_out, &r);
+  ec_felem_mul(group, &y_out, &y_out, &r);
   EC_FELEM s1j;
-  ec_GFp_mont_felem_mul(group, &s1j, &s1, &j);
+  ec_felem_mul(group, &s1j, &s1, &j);
   ec_felem_sub(group, &y_out, &y_out, &s1j);
   ec_felem_sub(group, &y_out, &y_out, &s1j);
 
@@ -274,8 +216,8 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
   ec_felem_select(group, &out->Z, z2nz, &z_out, &a->Z);
 }
 
-void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
-                     const EC_JACOBIAN *a) {
+void bssl::ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
+                           const EC_JACOBIAN *a) {
   if (group->a_is_minus3) {
     // The method is taken from:
     //   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
@@ -285,11 +227,11 @@ void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
     // <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L201>
     EC_FELEM delta, gamma, beta, ftmp, ftmp2, tmptmp, alpha, fourbeta;
     // delta = z^2
-    ec_GFp_mont_felem_sqr(group, &delta, &a->Z);
+    ec_felem_sqr(group, &delta, &a->Z);
     // gamma = y^2
-    ec_GFp_mont_felem_sqr(group, &gamma, &a->Y);
+    ec_felem_sqr(group, &gamma, &a->Y);
     // beta = x*gamma
-    ec_GFp_mont_felem_mul(group, &beta, &a->X, &gamma);
+    ec_felem_mul(group, &beta, &a->X, &gamma);
 
     // alpha = 3*(x-delta)*(x+delta)
     ec_felem_sub(group, &ftmp, &a->X, &delta);
@@ -297,10 +239,10 @@ void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
 
     ec_felem_add(group, &tmptmp, &ftmp2, &ftmp2);
     ec_felem_add(group, &ftmp2, &ftmp2, &tmptmp);
-    ec_GFp_mont_felem_mul(group, &alpha, &ftmp, &ftmp2);
+    ec_felem_mul(group, &alpha, &ftmp, &ftmp2);
 
     // x' = alpha^2 - 8*beta
-    ec_GFp_mont_felem_sqr(group, &r->X, &alpha);
+    ec_felem_sqr(group, &r->X, &alpha);
     ec_felem_add(group, &fourbeta, &beta, &beta);
     ec_felem_add(group, &fourbeta, &fourbeta, &fourbeta);
     ec_felem_add(group, &tmptmp, &fourbeta, &fourbeta);
@@ -309,14 +251,14 @@ void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
     // z' = (y + z)^2 - gamma - delta
     ec_felem_add(group, &delta, &gamma, &delta);
     ec_felem_add(group, &ftmp, &a->Y, &a->Z);
-    ec_GFp_mont_felem_sqr(group, &r->Z, &ftmp);
+    ec_felem_sqr(group, &r->Z, &ftmp);
     ec_felem_sub(group, &r->Z, &r->Z, &delta);
 
     // y' = alpha*(4*beta - x') - 8*gamma^2
     ec_felem_sub(group, &r->Y, &fourbeta, &r->X);
     ec_felem_add(group, &gamma, &gamma, &gamma);
-    ec_GFp_mont_felem_sqr(group, &gamma, &gamma);
-    ec_GFp_mont_felem_mul(group, &r->Y, &alpha, &r->Y);
+    ec_felem_sqr(group, &gamma, &gamma);
+    ec_felem_mul(group, &r->Y, &alpha, &r->Y);
     ec_felem_add(group, &gamma, &gamma, &gamma);
     ec_felem_sub(group, &r->Y, &r->Y, &gamma);
   } else {
@@ -327,35 +269,35 @@ void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
     // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L102>
     // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L534>
     EC_FELEM xx, yy, yyyy, zz;
-    ec_GFp_mont_felem_sqr(group, &xx, &a->X);
-    ec_GFp_mont_felem_sqr(group, &yy, &a->Y);
-    ec_GFp_mont_felem_sqr(group, &yyyy, &yy);
-    ec_GFp_mont_felem_sqr(group, &zz, &a->Z);
+    ec_felem_sqr(group, &xx, &a->X);
+    ec_felem_sqr(group, &yy, &a->Y);
+    ec_felem_sqr(group, &yyyy, &yy);
+    ec_felem_sqr(group, &zz, &a->Z);
 
     // s = 2*((x_in + yy)^2 - xx - yyyy)
     EC_FELEM s;
     ec_felem_add(group, &s, &a->X, &yy);
-    ec_GFp_mont_felem_sqr(group, &s, &s);
+    ec_felem_sqr(group, &s, &s);
     ec_felem_sub(group, &s, &s, &xx);
     ec_felem_sub(group, &s, &s, &yyyy);
     ec_felem_add(group, &s, &s, &s);
 
     // m = 3*xx + a*zz^2
     EC_FELEM m;
-    ec_GFp_mont_felem_sqr(group, &m, &zz);
-    ec_GFp_mont_felem_mul(group, &m, &group->a, &m);
+    ec_felem_sqr(group, &m, &zz);
+    ec_felem_mul(group, &m, &group->a, &m);
     ec_felem_add(group, &m, &m, &xx);
     ec_felem_add(group, &m, &m, &xx);
     ec_felem_add(group, &m, &m, &xx);
 
     // x_out = m^2 - 2*s
-    ec_GFp_mont_felem_sqr(group, &r->X, &m);
+    ec_felem_sqr(group, &r->X, &m);
     ec_felem_sub(group, &r->X, &r->X, &s);
     ec_felem_sub(group, &r->X, &r->X, &s);
 
     // z_out = (y_in + z_in)^2 - yy - zz
     ec_felem_add(group, &r->Z, &a->Y, &a->Z);
-    ec_GFp_mont_felem_sqr(group, &r->Z, &r->Z);
+    ec_felem_sqr(group, &r->Z, &r->Z);
     ec_felem_sub(group, &r->Z, &r->Z, &yy);
     ec_felem_sub(group, &r->Z, &r->Z, &zz);
 
@@ -364,7 +306,7 @@ void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
     ec_felem_add(group, &yyyy, &yyyy, &yyyy);
     ec_felem_add(group, &yyyy, &yyyy, &yyyy);
     ec_felem_sub(group, &r->Y, &s, &r->X);
-    ec_GFp_mont_felem_mul(group, &r->Y, &r->Y, &m);
+    ec_felem_mul(group, &r->Y, &r->Y, &m);
     ec_felem_sub(group, &r->Y, &r->Y, &yyyy);
   }
 }
@@ -387,11 +329,11 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
   // r*Z^2. Note that X and Z are represented in Montgomery form, while r is
   // not.
   EC_FELEM r_Z2, Z2_mont, X;
-  ec_GFp_mont_felem_mul(group, &Z2_mont, &p->Z, &p->Z);
+  ec_felem_sqr(group, &Z2_mont, &p->Z);
   // r < order < p, so this is valid.
   OPENSSL_memcpy(r_Z2.words, r->words, group->field.N.width * sizeof(BN_ULONG));
-  ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
-  ec_GFp_mont_felem_from_montgomery(group, &X, &p->X);
+  ec_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
+  ec_felem_from_montgomery(group, &X, &p->X);
 
   if (ec_felem_equal(group, &r_Z2, &X)) {
     return 1;
@@ -399,14 +341,14 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
 
   // During signing the x coefficient is reduced modulo the group order.
   // Therefore there is a small possibility, less than 1/2^128, that group_order
-  // < p.x < P. in that case we need not only to compare against |r| but also to
+  // < p.x < P. in that case we need not only to compare against `r` but also to
   // compare against r+group_order.
   BN_ULONG carry = bn_add_words(r_Z2.words, r->words, group->order.N.d,
                                 group->field.N.width);
   if (carry == 0 &&
       bn_less_than_words(r_Z2.words, group->field.N.d, group->field.N.width)) {
     // r + group_order < p, so compare (r + group_order) * Z^2 against X.
-    ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
+    ec_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
     if (ec_felem_equal(group, &r_Z2, &X)) {
       return 1;
     }
@@ -415,6 +357,8 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
   return 0;
 }
 
+BSSL_NAMESPACE_BEGIN
+
 DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) {
   out->point_get_affine_coordinates = ec_GFp_mont_point_get_affine_coordinates;
   out->jacobian_to_affine_batch = ec_GFp_mont_jacobian_to_affine_batch;
@@ -426,14 +370,10 @@ DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) {
   out->mul_public_batch = ec_GFp_mont_mul_public_batch;
   out->init_precomp = ec_GFp_mont_init_precomp;
   out->mul_precomp = ec_GFp_mont_mul_precomp;
-  out->felem_mul = ec_GFp_mont_felem_mul;
-  out->felem_sqr = ec_GFp_mont_felem_sqr;
-  out->felem_to_bytes = ec_GFp_mont_felem_to_bytes;
-  out->felem_from_bytes = ec_GFp_mont_felem_from_bytes;
-  out->felem_reduce = ec_GFp_mont_felem_reduce;
-  out->felem_exp = ec_GFp_mont_felem_exp;
   out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery;
   out->scalar_to_montgomery_inv_vartime =
       ec_simple_scalar_to_montgomery_inv_vartime;
   out->cmp_x_coordinate = ec_GFp_mont_cmp_x_coordinate;
 }
+
+BSSL_NAMESPACE_END

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/felem.cc.inc

@@ -18,17 +18,20 @@
 
 #include <assert.h>
 
-#include "internal.h"
-#include "../bn/internal.h"
 #include "../../internal.h"
+#include "../bn/internal.h"
+#include "internal.h"
 
 
-const EC_FELEM *ec_felem_one(const EC_GROUP *group) {
+using namespace bssl;
+
+const EC_FELEM *bssl::ec_felem_one(const EC_GROUP *group) {
   // We reuse generator.Z as a cache for 1 in the field.
   return &group->generator.raw.Z;
 }
 
-int ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out, const BIGNUM *in) {
+int bssl::ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out,
+                             const BIGNUM *in) {
   uint8_t bytes[EC_MAX_BYTES];
   size_t len = BN_num_bytes(&group->field.N);
   assert(sizeof(bytes) >= len);
@@ -41,24 +44,42 @@ int ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out, const BIGNUM *in) {
   return ec_felem_from_bytes(group, out, bytes, len);
 }
 
-int ec_felem_to_bignum(const EC_GROUP *group, BIGNUM *out, const EC_FELEM *in) {
+int bssl::ec_felem_to_bignum(const EC_GROUP *group, BIGNUM *out,
+                             const EC_FELEM *in) {
   uint8_t bytes[EC_MAX_BYTES];
   size_t len;
   ec_felem_to_bytes(group, bytes, &len, in);
-  return BN_bin2bn(bytes, len, out) != NULL;
+  return BN_bin2bn(bytes, len, out) != nullptr;
 }
 
-void ec_felem_to_bytes(const EC_GROUP *group, uint8_t *out, size_t *out_len,
-                       const EC_FELEM *in) {
-  group->meth->felem_to_bytes(group, out, out_len, in);
+void bssl::ec_felem_to_bytes(const EC_GROUP *group, uint8_t *out,
+                             size_t *out_len, const EC_FELEM *in) {
+  EC_FELEM tmp;
+  ec_felem_from_montgomery(group, &tmp, in);
+  size_t len = BN_num_bytes(&group->field.N);
+  bn_words_to_big_endian(out, len, tmp.words, group->field.N.width);
+  *out_len = len;
 }
 
-int ec_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out, const uint8_t *in,
-                        size_t len) {
-  return group->meth->felem_from_bytes(group, out, in, len);
+int bssl::ec_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out,
+                              const uint8_t *in, size_t len) {
+  if (len != BN_num_bytes(&group->field.N)) {
+    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
+    return 0;
+  }
+
+  bn_big_endian_to_words(out->words, group->field.N.width, in, len);
+  if (!bn_less_than_words(out->words, group->field.N.d, group->field.N.width)) {
+    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
+    return 0;
+  }
+
+  ec_felem_to_montgomery(group, out, out);
+  return 1;
 }
 
-void ec_felem_neg(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a) {
+void bssl::ec_felem_neg(const EC_GROUP *group, EC_FELEM *out,
+                        const EC_FELEM *a) {
   // -a is zero if a is zero and p-a otherwise.
   BN_ULONG mask = ec_felem_non_zero_mask(group, a);
   BN_ULONG borrow = bn_sub_words(out->words, group->field.N.d, a->words,
@@ -70,21 +91,22 @@ void ec_felem_neg(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a) {
   }
 }
 
-void ec_felem_add(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
-                  const EC_FELEM *b) {
+void bssl::ec_felem_add(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
+                        const EC_FELEM *b) {
   EC_FELEM tmp;
   bn_mod_add_words(out->words, a->words, b->words, group->field.N.d, tmp.words,
                    group->field.N.width);
 }
 
-void ec_felem_sub(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
-                  const EC_FELEM *b) {
+void bssl::ec_felem_sub(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
+                        const EC_FELEM *b) {
   EC_FELEM tmp;
   bn_mod_sub_words(out->words, a->words, b->words, group->field.N.d, tmp.words,
                    group->field.N.width);
 }
 
-BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) {
+BN_ULONG bssl::ec_felem_non_zero_mask(const EC_GROUP *group,
+                                      const EC_FELEM *a) {
   BN_ULONG mask = 0;
   for (int i = 0; i < group->field.N.width; i++) {
     mask |= a->words[i];
@@ -92,13 +114,54 @@ BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) {
   return ~constant_time_is_zero_w(mask);
 }
 
-void ec_felem_select(const EC_GROUP *group, EC_FELEM *out, BN_ULONG mask,
-                     const EC_FELEM *a, const EC_FELEM *b) {
+void bssl::ec_felem_select(const EC_GROUP *group, EC_FELEM *out, BN_ULONG mask,
+                           const EC_FELEM *a, const EC_FELEM *b) {
   bn_select_words(out->words, mask, a->words, b->words, group->field.N.width);
 }
 
-int ec_felem_equal(const EC_GROUP *group, const EC_FELEM *a,
-                   const EC_FELEM *b) {
+int bssl::ec_felem_equal(const EC_GROUP *group, const EC_FELEM *a,
+                         const EC_FELEM *b) {
   return CRYPTO_memcmp(a->words, b->words,
                        group->field.N.width * sizeof(BN_ULONG)) == 0;
 }
+
+void bssl::ec_felem_mul(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
+                        const EC_FELEM *b) {
+  bn_mod_mul_montgomery_small(out->words, a->words, b->words,
+                              group->field.N.width, &group->field);
+}
+
+void bssl::ec_felem_sqr(const EC_GROUP *group, EC_FELEM *out,
+                        const EC_FELEM *a) {
+  bn_mod_mul_montgomery_small(out->words, a->words, a->words,
+                              group->field.N.width, &group->field);
+}
+
+void bssl::ec_felem_to_montgomery(const EC_GROUP *group, EC_FELEM *out,
+                                  const EC_FELEM *a) {
+  bn_to_montgomery_small(out->words, a->words, group->field.N.width,
+                         &group->field);
+}
+
+void bssl::ec_felem_from_montgomery(const EC_GROUP *group, EC_FELEM *out,
+                                    const EC_FELEM *a) {
+  bn_from_montgomery_small(out->words, group->field.N.width, a->words,
+                           group->field.N.width, &group->field);
+}
+
+void bssl::ec_felem_reduce(const EC_GROUP *group, EC_FELEM *out,
+                           const BN_ULONG *words, size_t num) {
+  // Convert "from" Montgomery form so the value is reduced mod p.
+  bn_from_montgomery_small(out->words, group->field.N.width, words, num,
+                           &group->field);
+  // Convert "to" Montgomery form to remove the R^-1 factor added.
+  ec_felem_to_montgomery(group, out, out);
+  // Convert to Montgomery form to match this implementation's representation.
+  ec_felem_to_montgomery(group, out, out);
+}
+
+void bssl::ec_felem_exp(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
+                        const BN_ULONG *exp, size_t num_exp) {
+  bn_mod_exp_mont_small(out->words, a->words, group->field.N.width, exp,
+                        num_exp, &group->field);
+}