Add secp384r1 (NIST P-384) curve support

README.md

@@ -73,11 +73,13 @@ Crate provides support for following elliptic curves out of box:
 |--------------|--------------------|-------------------|
 | secp256k1    | `curve-secp256k1`  | [RustCrypto/k256] |
 | secp256r1    | `curve-secp256r1`  | [RustCrypto/p256] |
+| secp384r1    | `curve-secp384r1`  | [RustCrypto/p384] |
 | stark-curve  | `curve-stark`      | [Dfns/stark]      |
 | Ed25519      | `curve-ed25519`    | [curve25519-dalek]|
 
 [RustCrypto/k256]: https://github.com/RustCrypto/elliptic-curves/tree/master/k256
 [RustCrypto/p256]: https://github.com/RustCrypto/elliptic-curves/tree/master/p256
+[RustCrypto/p384]: https://github.com/RustCrypto/elliptic-curves/tree/master/p384
 [Dfns/stark]: https://github.com/LFDT-Lockness/stark-curve/
 [curve25519-dalek]: https://docs.rs/curve25519-dalek/
 

generic-ec-curves/Cargo.toml

@@ -18,6 +18,7 @@ zeroize = { workspace = true, features = ["zeroize_derive"] }
 elliptic-curve = { version = "0.13", default-features = false, features = ["sec1", "hash2curve"], optional = true }
 k256 = { version = "0.13", optional = true, default-features = false, features = ["hash2curve"] }
 p256 = { version = "0.13", optional = true, default-features = false, features = ["hash2curve"] }
+p384 = { version = "0.13", optional = true, default-features = false, features = ["hash2curve"] }
 sha2 = { workspace = true, optional = true }
 stark-curve = { version = "0.1", default-features = false, optional = true }
 
@@ -39,6 +40,7 @@ default = []
 rust-crypto = ["elliptic-curve"]
 secp256k1 = ["rust-crypto", "k256", "sha2"]
 secp256r1 = ["rust-crypto", "p256", "sha2"]
+secp384r1 = ["rust-crypto", "p384", "sha2"]
 stark = ["rust-crypto", "stark-curve", "sha2"]
 ed25519 = ["dep:curve25519", "dep:group"]
 

generic-ec-curves/benches/curves.rs

@@ -14,6 +14,9 @@ fn bench_curves(c: &mut criterion::Criterion) {
     bench_curve::<generic_ec_curves::Secp256r1>(c, &mut rng, "secp256r1");
     bench_bytes_reduction::<generic_ec_curves::Secp256r1, 32>(c, &mut rng, "secp256r1");
 
+    bench_curve::<generic_ec_curves::Secp384r1>(c, &mut rng, "secp384r1");
+    bench_bytes_reduction::<generic_ec_curves::Secp384r1, 48>(c, &mut rng, "secp384r1");
+
     bench_curve::<generic_ec_curves::Stark>(c, &mut rng, "stark");
     bench_bytes_reduction::<generic_ec_curves::Stark, 32>(c, &mut rng, "stark");
 

generic-ec-curves/src/lib.rs

@@ -6,7 +6,7 @@
 //! [`generic-ec` crate]: https://docs.rs/generic-ec
 
 #![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used))]
-#![cfg_attr(docsrs, feature(doc_cfg, doc_auto_cfg))]
+#![cfg_attr(docsrs, feature(doc_cfg))]
 #![forbid(missing_docs)]
 #![no_std]
 
@@ -27,6 +27,9 @@ pub use rust_crypto::Secp256k1;
 #[cfg(feature = "secp256r1")]
 pub use rust_crypto::Secp256r1;
 
+#[cfg(feature = "secp384r1")]
+pub use rust_crypto::Secp384r1;
+
 #[cfg(feature = "stark")]
 pub use rust_crypto::Stark;
 

generic-ec-curves/src/rust_crypto/curve_name.rs

@@ -14,6 +14,11 @@ impl CurveName for k256::Secp256k1 {
     const CURVE_NAME: &'static str = "secp256k1";
 }
 
+#[cfg(feature = "secp384r1")]
+impl CurveName for p384::NistP384 {
+    const CURVE_NAME: &'static str = "secp384r1";
+}
+
 #[cfg(feature = "stark")]
 impl CurveName for stark_curve::StarkCurve {
     const CURVE_NAME: &'static str = "stark";

generic-ec-curves/src/rust_crypto/mod.rs

@@ -67,6 +67,12 @@ pub type Secp256k1 = RustCryptoCurve<k256::Secp256k1, ExpandMsgXmd<Sha256>>;
 #[cfg(feature = "secp256r1")]
 pub type Secp256r1 = RustCryptoCurve<p256::NistP256, ExpandMsgXmd<Sha256>>;
 
+/// secp384r1 curve (NIST P-384)
+///
+/// Based on [p384] crate
+#[cfg(feature = "secp384r1")]
+pub type Secp384r1 = RustCryptoCurve<p384::NistP384, ExpandMsgXmd<sha2::Sha384>>;
+
 /// Stark curve
 ///
 /// Based on [stark_curve] crate
@@ -175,6 +181,13 @@ unsafe impl NoInvalidPoints for Secp256r1 {}
 /// Safe because:
 /// - RustCrypto curves are always on curve:
 ///   generic-ec-curves/src/rust_crypto/point.rs:60
+/// - p384 is prime order and so is always torsion-free:
+///   <https://github.com/RustCrypto/elliptic-curves/blob/7a71e403e49fbe92d6b2ae8fe3eabbfdef124975/primeorder/src/projective.rs#L172-L174>
+#[cfg(feature = "secp384r1")]
+unsafe impl NoInvalidPoints for Secp384r1 {}
+/// Safe because:
+/// - RustCrypto curves are always on curve:
+///   generic-ec-curves/src/rust_crypto/point.rs:60
 /// - stark is prime order and so is always torsion-free:
 ///   <https://github.com/RustCrypto/elliptic-curves/blob/7a71e403e49fbe92d6b2ae8fe3eabbfdef124975/primeorder/src/projective.rs#L172-L174>
 #[cfg(feature = "stark")]
@@ -187,7 +200,7 @@ mod tests {
         Curve,
     };
 
-    use super::{Secp256k1, Secp256r1, Stark};
+    use super::{Secp256k1, Secp256r1, Secp384r1, Stark};
 
     /// Asserts that `E` implements `Curve`
     fn _impls_curve<E: Curve>() {}
@@ -196,10 +209,12 @@ mod tests {
     fn _curves_impl_trait() {
         _impls_curve::<Secp256k1>();
         _impls_curve::<Secp256r1>();
+        _impls_curve::<Secp384r1>();
         _impls_curve::<Stark>();
 
         _exposes_affine_coords::<Secp256k1>();
         _exposes_affine_coords::<Secp256r1>();
+        _exposes_affine_coords::<Secp384r1>();
         _exposes_affine_coords::<Stark>();
     }
 }

generic-ec-curves/src/rust_crypto/scalar.rs

@@ -1,6 +1,6 @@
 use core::ops::Mul;
 
-use elliptic_curve::bigint::{ArrayEncoding, ByteArray, U256, U512};
+use elliptic_curve::bigint::{ArrayEncoding, ByteArray, U256, U384, U512};
 use elliptic_curve::{Curve, CurveArithmetic, Field, Group, ScalarPrimitive};
 use generic_ec_core::{
     Additive, CurveGenerator, FromUniformBytes, IntegerEncoding, Invertible, Multiplicative, One,
@@ -108,6 +108,17 @@ impl FromUniformBytes for RustCryptoScalar<p256::NistP256> {
         BytesModOrder::from_be_bytes_mod_order(bytes)
     }
 }
+#[cfg(feature = "secp384r1")]
+impl FromUniformBytes for RustCryptoScalar<p384::NistP384> {
+    /// 64 bytes
+    ///
+    /// `L = ceil((ceil(log2(q)) + k) / 8) = ceil((384 + 128) / 8) = 64` bytes are enough to
+    /// guarantee the uniform distribution
+    type Bytes = [u8; 64];
+    fn from_uniform_bytes(bytes: &Self::Bytes) -> Self {
+        BytesModOrder::from_be_bytes_mod_order(bytes)
+    }
+}
 #[cfg(feature = "stark")]
 impl FromUniformBytes for RustCryptoScalar<stark_curve::StarkCurve> {
     /// 48 bytes
@@ -265,6 +276,22 @@ where
     }
 }
 
+impl<E: CurveArithmetic + Curve> Reduce<48> for RustCryptoScalar<E>
+where
+    E::Scalar: elliptic_curve::ops::Reduce<U384>,
+{
+    fn from_be_array_mod_order(bytes: &[u8; 48]) -> Self {
+        Self(elliptic_curve::ops::Reduce::<U384>::reduce(
+            U384::from_be_byte_array((*bytes).into()),
+        ))
+    }
+    fn from_le_array_mod_order(bytes: &[u8; 48]) -> Self {
+        Self(elliptic_curve::ops::Reduce::<U384>::reduce(
+            U384::from_le_byte_array((*bytes).into()),
+        ))
+    }
+}
+
 /// Choice of algorithm for computing bytes mod curve order. Efficient algorithm
 /// is different for different curves.
 pub(super) trait BytesModOrder {
@@ -284,22 +311,43 @@ impl BytesModOrder for RustCryptoScalar<k256::Secp256k1> {
 #[cfg(feature = "secp256r1")]
 impl BytesModOrder for RustCryptoScalar<p256::NistP256> {
     fn from_be_bytes_mod_order(bytes: &[u8]) -> Self {
-        crate::utils::scalar_from_be_bytes_mod_order_reducing_32(bytes, &Self(p256::Scalar::ONE))
+        crate::utils::scalar_from_be_bytes_mod_order_reducing::<_, 32>(
+            bytes,
+            &Self(p256::Scalar::ONE),
+        )
     }
     fn from_le_bytes_mod_order(bytes: &[u8]) -> Self {
-        crate::utils::scalar_from_le_bytes_mod_order_reducing_32(bytes, &Self(p256::Scalar::ONE))
+        crate::utils::scalar_from_le_bytes_mod_order_reducing::<_, 32>(
+            bytes,
+            &Self(p256::Scalar::ONE),
+        )
+    }
+}
+#[cfg(feature = "secp384r1")]
+impl BytesModOrder for RustCryptoScalar<p384::NistP384> {
+    fn from_be_bytes_mod_order(bytes: &[u8]) -> Self {
+        crate::utils::scalar_from_be_bytes_mod_order_reducing::<_, 48>(
+            bytes,
+            &Self(p384::Scalar::ONE),
+        )
+    }
+    fn from_le_bytes_mod_order(bytes: &[u8]) -> Self {
+        crate::utils::scalar_from_le_bytes_mod_order_reducing::<_, 48>(
+            bytes,
+            &Self(p384::Scalar::ONE),
+        )
     }
 }
 #[cfg(feature = "stark")]
 impl BytesModOrder for RustCryptoScalar<stark_curve::StarkCurve> {
     fn from_be_bytes_mod_order(bytes: &[u8]) -> Self {
-        crate::utils::scalar_from_be_bytes_mod_order_reducing_32(
+        crate::utils::scalar_from_be_bytes_mod_order_reducing::<_, 32>(
             bytes,
             &Self(stark_curve::Scalar::ONE),
         )
     }
     fn from_le_bytes_mod_order(bytes: &[u8]) -> Self {
-        crate::utils::scalar_from_le_bytes_mod_order_reducing_32(
+        crate::utils::scalar_from_le_bytes_mod_order_reducing::<_, 32>(
             bytes,
             &Self(stark_curve::Scalar::ONE),
         )