ecp_nistp224.c

	copy_conditional(x_out, x1, z2_is_zero);
	copy_conditional(y_out, y2, z1_is_zero);
	copy_conditional(y_out, y1, z2_is_zero);
	copy_conditional(z_out, z2, z1_is_zero);
	copy_conditional(z_out, z1, z2_is_zero);
	felem_assign(x3, x_out);
	felem_assign(y3, y_out);
	felem_assign(z3, z_out);
	}

/* select_point selects the |idx|th point from a precomputation table and
 * copies it to out. */
static void select_point(const u64 idx, unsigned int size, const felem pre_comp[/*size*/][3], felem out[3])
	{
	unsigned i, j;
	limb *outlimbs = &out[0][0];
	memset(outlimbs, 0, 3 * sizeof(felem));

	for (i = 0; i < size; i++)
		{
		const limb *inlimbs = &pre_comp[i][0][0];
		u64 mask = i ^ idx;
		mask |= mask >> 4;
		mask |= mask >> 2;
		mask |= mask >> 1;
		mask &= 1;
		mask--;
		for (j = 0; j < 4 * 3; j++)
			outlimbs[j] |= inlimbs[j] & mask;
		}
	}

/* get_bit returns the |i|th bit in |in| */
static char get_bit(const felem_bytearray in, unsigned i)
	{
	if (i >= 224)
		return 0;
	return (in[i >> 3] >> (i & 7)) & 1;
	}

/* Interleaved point multiplication using precomputed point multiples:
 * The small point multiples 0*P, 1*P, ..., 16*P are in pre_comp[],
 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple
 * of the generator, using certain (large) precomputed multiples in g_pre_comp.
 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */
static void batch_mul(felem x_out, felem y_out, felem z_out,
	const felem_bytearray scalars[], const unsigned num_points, const u8 *g_scalar,
	const int mixed, const felem pre_comp[][17][3], const felem g_pre_comp[2][16][3])
	{
	int i, skip;
	unsigned num;
	unsigned gen_mul = (g_scalar != NULL);
	felem nq[3], tmp[4];
	u64 bits;
	u8 sign, digit;

	/* set nq to the point at infinity */
	memset(nq, 0, 3 * sizeof(felem));

	/* Loop over all scalars msb-to-lsb, interleaving additions
	 * of multiples of the generator (two in each of the last 28 rounds)
	 * and additions of other points multiples (every 5th round).
	 */
	skip = 1; /* save two point operations in the first round */
	for (i = (num_points ? 220 : 27); i >= 0; --i)
		{
		/* double */
		if (!skip)
			point_double(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2]);

		/* add multiples of the generator */
		if (gen_mul && (i <= 27))
			{
			/* first, look 28 bits upwards */
			bits = get_bit(g_scalar, i + 196) << 3;
			bits |= get_bit(g_scalar, i + 140) << 2;
			bits |= get_bit(g_scalar, i + 84) << 1;
			bits |= get_bit(g_scalar, i + 28);
			/* select the point to add, in constant time */
			select_point(bits, 16, g_pre_comp[1], tmp);

			if (!skip)
				{
				point_add(nq[0], nq[1], nq[2],
					nq[0], nq[1], nq[2],
					1 /* mixed */, tmp[0], tmp[1], tmp[2]);
				}
			else
				{
				memcpy(nq, tmp, 3 * sizeof(felem));
				skip = 0;
				}

			/* second, look at the current position */
			bits = get_bit(g_scalar, i + 168) << 3;
			bits |= get_bit(g_scalar, i + 112) << 2;
			bits |= get_bit(g_scalar, i + 56) << 1;
			bits |= get_bit(g_scalar, i);
			/* select the point to add, in constant time */
			select_point(bits, 16, g_pre_comp[0], tmp);
			point_add(nq[0], nq[1], nq[2],
				nq[0], nq[1], nq[2],
				1 /* mixed */, tmp[0], tmp[1], tmp[2]);
			}

		/* do other additions every 5 doublings */
		if (num_points && (i % 5 == 0))
			{
			/* loop over all scalars */
			for (num = 0; num < num_points; ++num)
				{
				bits = get_bit(scalars[num], i + 4) << 5;
				bits |= get_bit(scalars[num], i + 3) << 4;
				bits |= get_bit(scalars[num], i + 2) << 3;
				bits |= get_bit(scalars[num], i + 1) << 2;
				bits |= get_bit(scalars[num], i) << 1;
				bits |= get_bit(scalars[num], i - 1);
				ec_GFp_nistp_recode_scalar_bits(&sign, &digit, bits);

				/* select the point to add or subtract */
				select_point(digit, 17, pre_comp[num], tmp);
				felem_neg(tmp[3], tmp[1]); /* (X, -Y, Z) is the negative point */
				copy_conditional(tmp[1], tmp[3], sign);

				if (!skip)
					{
					point_add(nq[0], nq[1], nq[2],
						nq[0], nq[1], nq[2],
						mixed, tmp[0], tmp[1], tmp[2]);
					}
				else
					{
					memcpy(nq, tmp, 3 * sizeof(felem));
					skip = 0;
					}
				}
			}
		}
	felem_assign(x_out, nq[0]);
	felem_assign(y_out, nq[1]);
	felem_assign(z_out, nq[2]);
	}

/******************************************************************************/
/*		       FUNCTIONS TO MANAGE PRECOMPUTATION
 */

static NISTP224_PRE_COMP *nistp224_pre_comp_new()
	{
	NISTP224_PRE_COMP *ret = NULL;
	ret = (NISTP224_PRE_COMP *) OPENSSL_malloc(sizeof *ret);
	if (!ret)
		{
		ECerr(EC_F_NISTP224_PRE_COMP_NEW, ERR_R_MALLOC_FAILURE);
		return ret;
		}
	memset(ret->g_pre_comp, 0, sizeof(ret->g_pre_comp));
	ret->references = 1;
	return ret;
	}

static void *nistp224_pre_comp_dup(void *src_)
	{
	NISTP224_PRE_COMP *src = src_;

	/* no need to actually copy, these objects never change! */
	CRYPTO_add(&src->references, 1, CRYPTO_LOCK_EC_PRE_COMP);

	return src_;
	}

static void nistp224_pre_comp_free(void *pre_)
	{
	int i;
	NISTP224_PRE_COMP *pre = pre_;

	if (!pre)
		return;

	i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP);
	if (i > 0)
		return;

	OPENSSL_free(pre);
	}

static void nistp224_pre_comp_clear_free(void *pre_)
	{
	int i;
	NISTP224_PRE_COMP *pre = pre_;

	if (!pre)
		return;

	i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP);
	if (i > 0)
		return;

	OPENSSL_cleanse(pre, sizeof *pre);
	OPENSSL_free(pre);
	}

/******************************************************************************/
/*			   OPENSSL EC_METHOD FUNCTIONS
 */

int ec_GFp_nistp224_group_init(EC_GROUP *group)
	{
	int ret;
	ret = ec_GFp_simple_group_init(group);
	group->a_is_minus3 = 1;
	return ret;
	}

int ec_GFp_nistp224_group_set_curve(EC_GROUP *group, const BIGNUM *p,
	const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
	{
	int ret = 0;
	BN_CTX *new_ctx = NULL;
	BIGNUM *curve_p, *curve_a, *curve_b;

	if (ctx == NULL)
		if ((ctx = new_ctx = BN_CTX_new()) == NULL) return 0;
	BN_CTX_start(ctx);
	if (((curve_p = BN_CTX_get(ctx)) == NULL) ||
		((curve_a = BN_CTX_get(ctx)) == NULL) ||
		((curve_b = BN_CTX_get(ctx)) == NULL)) goto err;
	BN_bin2bn(nistp224_curve_params[0], sizeof(felem_bytearray), curve_p);
	BN_bin2bn(nistp224_curve_params[1], sizeof(felem_bytearray), curve_a);
	BN_bin2bn(nistp224_curve_params[2], sizeof(felem_bytearray), curve_b);
	if ((BN_cmp(curve_p, p)) || (BN_cmp(curve_a, a)) ||
		(BN_cmp(curve_b, b)))
		{
		ECerr(EC_F_EC_GFP_NISTP224_GROUP_SET_CURVE,
			EC_R_WRONG_CURVE_PARAMETERS);
		goto err;
		}
	group->field_mod_func = BN_nist_mod_224;
	ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
err:
	BN_CTX_end(ctx);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	return ret;
	}

/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns
 * (X', Y') = (X/Z^2, Y/Z^3) */
int ec_GFp_nistp224_point_get_affine_coordinates(const EC_GROUP *group,
	const EC_POINT *point, BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
	{
	felem z1, z2, x_in, y_in, x_out, y_out;
	widefelem tmp;

	if (EC_POINT_is_at_infinity(group, point))
		{
		ECerr(EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES,
			EC_R_POINT_AT_INFINITY);
		return 0;
		}
	if ((!BN_to_felem(x_in, &point->X)) || (!BN_to_felem(y_in, &point->Y)) ||
		(!BN_to_felem(z1, &point->Z))) return 0;
	felem_inv(z2, z1);
	felem_square(tmp, z2); felem_reduce(z1, tmp);
	felem_mul(tmp, x_in, z1); felem_reduce(x_in, tmp);
	felem_contract(x_out, x_in);
	if (x != NULL)
		{
		if (!felem_to_BN(x, x_out)) {
		ECerr(EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES,
			ERR_R_BN_LIB);
		return 0;
		}
		}
	felem_mul(tmp, z1, z2); felem_reduce(z1, tmp);
	felem_mul(tmp, y_in, z1); felem_reduce(y_in, tmp);
	felem_contract(y_out, y_in);
	if (y != NULL)
		{
		if (!felem_to_BN(y, y_out)) {
		ECerr(EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES,
			ERR_R_BN_LIB);
		return 0;
		}
		}
	return 1;
	}

static void make_points_affine(size_t num, felem points[/*num*/][3], felem tmp_felems[/*num+1*/])
	{
	/* Runs in constant time, unless an input is the point at infinity
	 * (which normally shouldn't happen). */
	ec_GFp_nistp_points_make_affine_internal(
		num,
		points,
		sizeof(felem),
		tmp_felems,
		(void (*)(void *)) felem_one,
		(int (*)(const void *)) felem_is_zero_int,
		(void (*)(void *, const void *)) felem_assign,
		(void (*)(void *, const void *)) felem_square_reduce,
		(void (*)(void *, const void *, const void *)) felem_mul_reduce,
		(void (*)(void *, const void *)) felem_inv,
		(void (*)(void *, const void *)) felem_contract);
	}

/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values
 * Result is stored in r (r can equal one of the inputs). */
int ec_GFp_nistp224_points_mul(const EC_GROUP *group, EC_POINT *r,
	const BIGNUM *scalar, size_t num, const EC_POINT *points[],
	const BIGNUM *scalars[], BN_CTX *ctx)
	{
	int ret = 0;
	int j;
	unsigned i;
	int mixed = 0;
	BN_CTX *new_ctx = NULL;
	BIGNUM *x, *y, *z, *tmp_scalar;
	felem_bytearray g_secret;
	felem_bytearray *secrets = NULL;
	felem (*pre_comp)[17][3] = NULL;
	felem *tmp_felems = NULL;
	felem_bytearray tmp;
	unsigned num_bytes;
	int have_pre_comp = 0;
	size_t num_points = num;
	felem x_in, y_in, z_in, x_out, y_out, z_out;
	NISTP224_PRE_COMP *pre = NULL;
	const felem (*g_pre_comp)[16][3] = NULL;
	EC_POINT *generator = NULL;
	const EC_POINT *p = NULL;
	const BIGNUM *p_scalar = NULL;

	if (ctx == NULL)
		if ((ctx = new_ctx = BN_CTX_new()) == NULL) return 0;
	BN_CTX_start(ctx);
	if (((x = BN_CTX_get(ctx)) == NULL) ||
		((y = BN_CTX_get(ctx)) == NULL) ||
		((z = BN_CTX_get(ctx)) == NULL) ||
		((tmp_scalar = BN_CTX_get(ctx)) == NULL))
		goto err;

	if (scalar != NULL)
		{
		pre = EC_EX_DATA_get_data(group->extra_data,
			nistp224_pre_comp_dup, nistp224_pre_comp_free,
			nistp224_pre_comp_clear_free);
		if (pre)
			/* we have precomputation, try to use it */
			g_pre_comp = (const felem (*)[16][3]) pre->g_pre_comp;
		else
			/* try to use the standard precomputation */
			g_pre_comp = &gmul[0];
		generator = EC_POINT_new(group);
		if (generator == NULL)
			goto err;
		/* get the generator from precomputation */
		if (!felem_to_BN(x, g_pre_comp[0][1][0]) ||
			!felem_to_BN(y, g_pre_comp[0][1][1]) ||
			!felem_to_BN(z, g_pre_comp[0][1][2]))
			{
			ECerr(EC_F_EC_GFP_NISTP224_POINTS_MUL, ERR_R_BN_LIB);
			goto err;
			}
		if (!EC_POINT_set_Jprojective_coordinates_GFp(group,
				generator, x, y, z, ctx))
			goto err;
		if (0 == EC_POINT_cmp(group, generator, group->generator, ctx))
			/* precomputation matches generator */
			have_pre_comp = 1;
		else
			/* we don't have valid precomputation:
			 * treat the generator as a random point */
			num_points = num_points + 1;
		}

	if (num_points > 0)
		{
		if (num_points >= 3)
			{
			/* unless we precompute multiples for just one or two points,
			 * converting those into affine form is time well spent  */
			mixed = 1;
			}
		secrets = OPENSSL_malloc(num_points * sizeof(felem_bytearray));
		pre_comp = OPENSSL_malloc(num_points * 17 * 3 * sizeof(felem));
		if (mixed)
			tmp_felems = OPENSSL_malloc((num_points * 17 + 1) * sizeof(felem));
		if ((secrets == NULL) || (pre_comp == NULL) || (mixed && (tmp_felems == NULL)))
			{
			ECerr(EC_F_EC_GFP_NISTP224_POINTS_MUL, ERR_R_MALLOC_FAILURE);
			goto err;
			}

		/* we treat NULL scalars as 0, and NULL points as points at infinity,
		 * i.e., they contribute nothing to the linear combination */
		memset(secrets, 0, num_points * sizeof(felem_bytearray));
		memset(pre_comp, 0, num_points * 17 * 3 * sizeof(felem));
		for (i = 0; i < num_points; ++i)
			{
			if (i == num)
				/* the generator */
				{
				p = EC_GROUP_get0_generator(group);
				p_scalar = scalar;
				}
			else
				/* the i^th point */
				{
				p = points[i];
				p_scalar = scalars[i];
				}
			if ((p_scalar != NULL) && (p != NULL))
				{
				/* reduce scalar to 0 <= scalar < 2^224 */
				if ((BN_num_bits(p_scalar) > 224) || (BN_is_negative(p_scalar)))
					{
					/* this is an unusual input, and we don't guarantee
					 * constant-timeness */
					if (!BN_nnmod(tmp_scalar, p_scalar, &group->order, ctx))
						{
						ECerr(EC_F_EC_GFP_NISTP224_POINTS_MUL, ERR_R_BN_LIB);
						goto err;
						}
					num_bytes = BN_bn2bin(tmp_scalar, tmp);
					}
				else
					num_bytes = BN_bn2bin(p_scalar, tmp);
				flip_endian(secrets[i], tmp, num_bytes);
				/* precompute multiples */
				if ((!BN_to_felem(x_out, &p->X)) ||
					(!BN_to_felem(y_out, &p->Y)) ||
					(!BN_to_felem(z_out, &p->Z))) goto err;
				felem_assign(pre_comp[i][1][0], x_out);
				felem_assign(pre_comp[i][1][1], y_out);
				felem_assign(pre_comp[i][1][2], z_out);
				for (j = 2; j <= 16; ++j)
					{
					if (j & 1)
						{
						point_add(
							pre_comp[i][j][0], pre_comp[i][j][1], pre_comp[i][j][2],
							pre_comp[i][1][0], pre_comp[i][1][1], pre_comp[i][1][2],
							0, pre_comp[i][j-1][0], pre_comp[i][j-1][1], pre_comp[i][j-1][2]);
						}
					else
						{
						point_double(
							pre_comp[i][j][0], pre_comp[i][j][1], pre_comp[i][j][2],
							pre_comp[i][j/2][0], pre_comp[i][j/2][1], pre_comp[i][j/2][2]);
						}
					}
				}
			}
		if (mixed)
			make_points_affine(num_points * 17, pre_comp[0], tmp_felems);
		}

	/* the scalar for the generator */
	if ((scalar != NULL) && (have_pre_comp))
		{
		memset(g_secret, 0, sizeof g_secret);
		/* reduce scalar to 0 <= scalar < 2^224 */
		if ((BN_num_bits(scalar) > 224) || (BN_is_negative(scalar)))
			{
			/* this is an unusual input, and we don't guarantee
			 * constant-timeness */
			if (!BN_nnmod(tmp_scalar, scalar, &group->order, ctx))
				{
				ECerr(EC_F_EC_GFP_NISTP224_POINTS_MUL, ERR_R_BN_LIB);
				goto err;
				}
			num_bytes = BN_bn2bin(tmp_scalar, tmp);
			}
		else
			num_bytes = BN_bn2bin(scalar, tmp);
		flip_endian(g_secret, tmp, num_bytes);
		/* do the multiplication with generator precomputation*/
		batch_mul(x_out, y_out, z_out,
			(const felem_bytearray (*)) secrets, num_points,
			g_secret,
			mixed, (const felem (*)[17][3]) pre_comp,
			g_pre_comp);
		}
	else
		/* do the multiplication without generator precomputation */
		batch_mul(x_out, y_out, z_out,
			(const felem_bytearray (*)) secrets, num_points,
			NULL, mixed, (const felem (*)[17][3]) pre_comp, NULL);
	/* reduce the output to its unique minimal representation */
	felem_contract(x_in, x_out);
	felem_contract(y_in, y_out);
	felem_contract(z_in, z_out);
	if ((!felem_to_BN(x, x_in)) || (!felem_to_BN(y, y_in)) ||
		(!felem_to_BN(z, z_in)))
		{
		ECerr(EC_F_EC_GFP_NISTP224_POINTS_MUL, ERR_R_BN_LIB);
		goto err;
		}
	ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx);

err:
	BN_CTX_end(ctx);
	if (generator != NULL)
		EC_POINT_free(generator);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	if (secrets != NULL)
		OPENSSL_free(secrets);
	if (pre_comp != NULL)
		OPENSSL_free(pre_comp);
	if (tmp_felems != NULL)
		OPENSSL_free(tmp_felems);
	return ret;
	}

int ec_GFp_nistp224_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
	{
	int ret = 0;
	NISTP224_PRE_COMP *pre = NULL;
	int i, j;
	BN_CTX *new_ctx = NULL;
	BIGNUM *x, *y;
	EC_POINT *generator = NULL;
	felem tmp_felems[32];

	/* throw away old precomputation */
	EC_EX_DATA_free_data(&group->extra_data, nistp224_pre_comp_dup,
		nistp224_pre_comp_free, nistp224_pre_comp_clear_free);
	if (ctx == NULL)
		if ((ctx = new_ctx = BN_CTX_new()) == NULL) return 0;
	BN_CTX_start(ctx);
	if (((x = BN_CTX_get(ctx)) == NULL) ||
		((y = BN_CTX_get(ctx)) == NULL))
		goto err;
	/* get the generator */
	if (group->generator == NULL) goto err;
	generator = EC_POINT_new(group);
	if (generator == NULL)
		goto err;
	BN_bin2bn(nistp224_curve_params[3], sizeof (felem_bytearray), x);
	BN_bin2bn(nistp224_curve_params[4], sizeof (felem_bytearray), y);
	if (!EC_POINT_set_affine_coordinates_GFp(group, generator, x, y, ctx))
		goto err;
	if ((pre = nistp224_pre_comp_new()) == NULL)
		goto err;
	/* if the generator is the standard one, use built-in precomputation */
	if (0 == EC_POINT_cmp(group, generator, group->generator, ctx))
		{
		memcpy(pre->g_pre_comp, gmul, sizeof(pre->g_pre_comp));
		ret = 1;
		goto err;
		}
	if ((!BN_to_felem(pre->g_pre_comp[0][1][0], &group->generator->X)) ||
		(!BN_to_felem(pre->g_pre_comp[0][1][1], &group->generator->Y)) ||
		(!BN_to_felem(pre->g_pre_comp[0][1][2], &group->generator->Z)))
		goto err;
	/* compute 2^56*G, 2^112*G, 2^168*G for the first table,
	 * 2^28*G, 2^84*G, 2^140*G, 2^196*G for the second one
	 */
	for (i = 1; i <= 8; i <<= 1)
		{
		point_double(
			pre->g_pre_comp[1][i][0], pre->g_pre_comp[1][i][1], pre->g_pre_comp[1][i][2],
			pre->g_pre_comp[0][i][0], pre->g_pre_comp[0][i][1], pre->g_pre_comp[0][i][2]);
		for (j = 0; j < 27; ++j)
			{
			point_double(
				pre->g_pre_comp[1][i][0], pre->g_pre_comp[1][i][1], pre->g_pre_comp[1][i][2],
				pre->g_pre_comp[1][i][0], pre->g_pre_comp[1][i][1], pre->g_pre_comp[1][i][2]);
			}
		if (i == 8)
			break;
		point_double(
			pre->g_pre_comp[0][2*i][0], pre->g_pre_comp[0][2*i][1], pre->g_pre_comp[0][2*i][2],
			pre->g_pre_comp[1][i][0], pre->g_pre_comp[1][i][1], pre->g_pre_comp[1][i][2]);
		for (j = 0; j < 27; ++j)
			{
			point_double(
				pre->g_pre_comp[0][2*i][0], pre->g_pre_comp[0][2*i][1], pre->g_pre_comp[0][2*i][2],
				pre->g_pre_comp[0][2*i][0], pre->g_pre_comp[0][2*i][1], pre->g_pre_comp[0][2*i][2]);
			}
		}
	for (i = 0; i < 2; i++)
		{
		/* g_pre_comp[i][0] is the point at infinity */
		memset(pre->g_pre_comp[i][0], 0, sizeof(pre->g_pre_comp[i][0]));
		/* the remaining multiples */
		/* 2^56*G + 2^112*G resp. 2^84*G + 2^140*G */
		point_add(
			pre->g_pre_comp[i][6][0], pre->g_pre_comp[i][6][1],
			pre->g_pre_comp[i][6][2], pre->g_pre_comp[i][4][0],
			pre->g_pre_comp[i][4][1], pre->g_pre_comp[i][4][2],
			0, pre->g_pre_comp[i][2][0], pre->g_pre_comp[i][2][1],
			pre->g_pre_comp[i][2][2]);
		/* 2^56*G + 2^168*G resp. 2^84*G + 2^196*G */
		point_add(
			pre->g_pre_comp[i][10][0], pre->g_pre_comp[i][10][1],
			pre->g_pre_comp[i][10][2], pre->g_pre_comp[i][8][0],
			pre->g_pre_comp[i][8][1], pre->g_pre_comp[i][8][2],
			0, pre->g_pre_comp[i][2][0], pre->g_pre_comp[i][2][1],
			pre->g_pre_comp[i][2][2]);
		/* 2^112*G + 2^168*G resp. 2^140*G + 2^196*G */
		point_add(
			pre->g_pre_comp[i][12][0], pre->g_pre_comp[i][12][1],
			pre->g_pre_comp[i][12][2], pre->g_pre_comp[i][8][0],
			pre->g_pre_comp[i][8][1], pre->g_pre_comp[i][8][2],
			0, pre->g_pre_comp[i][4][0], pre->g_pre_comp[i][4][1],
			pre->g_pre_comp[i][4][2]);
		/* 2^56*G + 2^112*G + 2^168*G resp. 2^84*G + 2^140*G + 2^196*G */
		point_add(
			pre->g_pre_comp[i][14][0], pre->g_pre_comp[i][14][1],
			pre->g_pre_comp[i][14][2], pre->g_pre_comp[i][12][0],
			pre->g_pre_comp[i][12][1], pre->g_pre_comp[i][12][2],
			0, pre->g_pre_comp[i][2][0], pre->g_pre_comp[i][2][1],
			pre->g_pre_comp[i][2][2]);
		for (j = 1; j < 8; ++j)
			{
			/* odd multiples: add G resp. 2^28*G */
			point_add(
				pre->g_pre_comp[i][2*j+1][0], pre->g_pre_comp[i][2*j+1][1],
				pre->g_pre_comp[i][2*j+1][2], pre->g_pre_comp[i][2*j][0],
				pre->g_pre_comp[i][2*j][1], pre->g_pre_comp[i][2*j][2],
				0, pre->g_pre_comp[i][1][0], pre->g_pre_comp[i][1][1],
				pre->g_pre_comp[i][1][2]);
			}
		}
	make_points_affine(31, &(pre->g_pre_comp[0][1]), tmp_felems);

	if (!EC_EX_DATA_set_data(&group->extra_data, pre, nistp224_pre_comp_dup,
			nistp224_pre_comp_free, nistp224_pre_comp_clear_free))
		goto err;
	ret = 1;
	pre = NULL;
 err:
	BN_CTX_end(ctx);
	if (generator != NULL)
		EC_POINT_free(generator);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	if (pre)
		nistp224_pre_comp_free(pre);
	return ret;
	}

int ec_GFp_nistp224_have_precompute_mult(const EC_GROUP *group)
	{
	if (EC_EX_DATA_get_data(group->extra_data, nistp224_pre_comp_dup,
			nistp224_pre_comp_free, nistp224_pre_comp_clear_free)
		!= NULL)
		return 1;
	else
		return 0;
	}

#else
static void *dummy=&dummy;
#endif