Search code examples
copensslfedora

Are the OpenSSL GFp functions slow drop in replacements for the GF2m functions?


I'm working with OpenSSL on a Fedora system, and Fedora defines OPENSSL_NO_EC2M, so functions like EC_POINT_get_affine_coordinates_GF2m aren't available. I have code that was written to use these functions that I would like to compile and run on Fedora. Is EC_POINT_get_affine_coordinates_GFp a drop-in (possibly slower) replacement? In general, are functions with GFp in the name drop in replacements for identically named functions that have GF2m in the name?

If they aren't, what should I do to port code that uses them to OpenSSL installations that don't have them?


Solution

  • GFp functions are intended for curves that use a prime field, while GF2m functions are intended for binary curves (see https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography for more information). In other words the underlying curve type is different. Any well behaved code that is written to use those GF2m functions should only be calling them in a context where it makes sense to do so, i.e. where it knows that the curve type is a binary curve. Since an OpenSSL library that has been built with OPENSSL_NO_EC2M defined does not have any binary curves available in it, it should never be the case that those codepaths are ever hit.

    It also turns out that the need for having those different functions in the API was somewhat spurious anyway. The library itself can figure out for itself what the underlying curve type is and do the right thing and the different implementations of most of the GFp/GF2m functions are identical anyway. For that reason many of these functions were recently scheduled for future deprecation (see https://github.com/openssl/openssl/commit/50db81633ec)

    Whether you can port code that supports binary curves to a version of the library that doesn't will depend on whether the code you are porting relies on binary curves as an essential part of its operation. In many cases code will support both prime and binary curves. Therefore you can simply use a prime field curve instead and simply comment out the bits of the code that support binary curves. However if it can only be a binary curve then you are out of luck.