* [PATCH] crypto: ecc - Add NIST P224 curve parameters
@ 2026-07-29 15:51 Paul Louvel
2026-07-29 16:43 ` Thomas Huth
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Paul Louvel @ 2026-07-29 15:51 UTC (permalink / raw)
To: Lukas Wunner, Ignat Korchagin, Stefan Berger, Herbert Xu,
David S. Miller
Cc: linux-crypto, linux-kernel, Thomas Petazzoni, Paul Louvel
Add the parameters for the NIST P224 curve and define a new curve ID for
it. Make the curve available in ecc_get_curve().
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
---
crypto/ecc.c | 2 ++
crypto/ecc_curve_defs.h | 27 +++++++++++++++++++++++++++
include/crypto/ecdh.h | 7 ++++---
3 files changed, 33 insertions(+), 3 deletions(-)
diff --git a/crypto/ecc.c b/crypto/ecc.c
index 6eb4d97a5f0d..6aa007420ab4 100644
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -56,6 +56,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
/* In FIPS mode only allow P256 and higher */
case ECC_CURVE_NIST_P192:
return fips_enabled ? NULL : &nist_p192;
+ case ECC_CURVE_NIST_P224:
+ return &nist_p224;
case ECC_CURVE_NIST_P256:
return &nist_p256;
case ECC_CURVE_NIST_P384:
diff --git a/crypto/ecc_curve_defs.h b/crypto/ecc_curve_defs.h
index 0ecade7d02f5..c67b73f2cd5a 100644
--- a/crypto/ecc_curve_defs.h
+++ b/crypto/ecc_curve_defs.h
@@ -29,6 +29,33 @@ static struct ecc_curve nist_p192 = {
.b = nist_p192_b
};
+/* NIST P-224: a = p - 3 */
+static u64 nist_p224_g_x[] = { 0x115c1d21ull, 0x56c21122343280d6ull,
+ 0x321390b94a03c1d3ull, 0xb70e0cbd6bb4bf7full };
+static u64 nist_p224_g_y[] = { 0x85007e34ull, 0x5a07476444d58199ull,
+ 0x4c22dfe6cd4375a0ull, 0xbd376388b5f723fbull };
+static u64 nist_p224_p[] = { 0x00000001ull, 0x0000000000000000ull,
+ 0xffffffffffffffffull, 0xffffffffffffffffull };
+static u64 nist_p224_n[] = { 0x5c5c2a3dull, 0xe0b8f03e13dd2945ull,
+ 0xffffffffffff16a2ull, 0xffffffffffffffffull };
+static u64 nist_p224_a[] = { 0xfffffffeull, 0xffffffffffffffffull,
+ 0xfffffffffffffffeull, 0xffffffffffffffffull };
+static u64 nist_p224_b[] = { 0x2355ffb4ull, 0xd7bfd8ba270b3943ull,
+ 0xf54132565044b0b7ull, 0xb4050a850c04b3abull };
+static struct ecc_curve nist_p224 = {
+ .name = "nist_224",
+ .nbits = 224,
+ .g = {
+ .x = nist_p224_g_x,
+ .y = nist_p224_g_y,
+ .ndigits = 4,
+ },
+ .p = nist_p224_p,
+ .n = nist_p224_n,
+ .a = nist_p224_a,
+ .b = nist_p224_b
+};
+
/* NIST P-256: a = p - 3 */
static u64 nist_p256_g_x[] = { 0xF4A13945D898C296ull, 0x77037D812DEB33A0ull,
0xF8BCE6E563A440F2ull, 0x6B17D1F2E12C4247ull };
diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
index 9784ecdd2fb4..07e0d3058f5f 100644
--- a/include/crypto/ecdh.h
+++ b/include/crypto/ecdh.h
@@ -24,9 +24,10 @@
/* Curves IDs */
#define ECC_CURVE_NIST_P192 0x0001
-#define ECC_CURVE_NIST_P256 0x0002
-#define ECC_CURVE_NIST_P384 0x0003
-#define ECC_CURVE_NIST_P521 0x0004
+#define ECC_CURVE_NIST_P224 0x0002
+#define ECC_CURVE_NIST_P256 0x0003
+#define ECC_CURVE_NIST_P384 0x0004
+#define ECC_CURVE_NIST_P521 0x0005
/**
* struct ecdh - define an ECDH private key
---
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
change-id: 20260729-add-nist-p224-curve-8612b49d6ba2
Best regards,
--
Paul Louvel, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters
2026-07-29 15:51 [PATCH] crypto: ecc - Add NIST P224 curve parameters Paul Louvel
@ 2026-07-29 16:43 ` Thomas Huth
2026-07-29 19:06 ` Paul Louvel
2026-07-29 16:50 ` Simo Sorce
2026-07-29 18:28 ` Lukas Wunner
2 siblings, 1 reply; 6+ messages in thread
From: Thomas Huth @ 2026-07-29 16:43 UTC (permalink / raw)
To: Paul Louvel, Lukas Wunner, Ignat Korchagin, Stefan Berger,
Herbert Xu, David S. Miller
Cc: linux-crypto, linux-kernel, Thomas Petazzoni
On 29/07/2026 17.51, Paul Louvel wrote:
> Add the parameters for the NIST P224 curve and define a new curve ID for
> it. Make the curve available in ecc_get_curve().
May I ask: Who's going to consume this?
Thomas
> Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
> ---
> crypto/ecc.c | 2 ++
> crypto/ecc_curve_defs.h | 27 +++++++++++++++++++++++++++
> include/crypto/ecdh.h | 7 ++++---
> 3 files changed, 33 insertions(+), 3 deletions(-)
>
> diff --git a/crypto/ecc.c b/crypto/ecc.c
> index 6eb4d97a5f0d..6aa007420ab4 100644
> --- a/crypto/ecc.c
> +++ b/crypto/ecc.c
> @@ -56,6 +56,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
> /* In FIPS mode only allow P256 and higher */
> case ECC_CURVE_NIST_P192:
> return fips_enabled ? NULL : &nist_p192;
> + case ECC_CURVE_NIST_P224:
> + return &nist_p224;
> case ECC_CURVE_NIST_P256:
> return &nist_p256;
> case ECC_CURVE_NIST_P384:
> diff --git a/crypto/ecc_curve_defs.h b/crypto/ecc_curve_defs.h
> index 0ecade7d02f5..c67b73f2cd5a 100644
> --- a/crypto/ecc_curve_defs.h
> +++ b/crypto/ecc_curve_defs.h
> @@ -29,6 +29,33 @@ static struct ecc_curve nist_p192 = {
> .b = nist_p192_b
> };
>
> +/* NIST P-224: a = p - 3 */
> +static u64 nist_p224_g_x[] = { 0x115c1d21ull, 0x56c21122343280d6ull,
> + 0x321390b94a03c1d3ull, 0xb70e0cbd6bb4bf7full };
> +static u64 nist_p224_g_y[] = { 0x85007e34ull, 0x5a07476444d58199ull,
> + 0x4c22dfe6cd4375a0ull, 0xbd376388b5f723fbull };
> +static u64 nist_p224_p[] = { 0x00000001ull, 0x0000000000000000ull,
> + 0xffffffffffffffffull, 0xffffffffffffffffull };
> +static u64 nist_p224_n[] = { 0x5c5c2a3dull, 0xe0b8f03e13dd2945ull,
> + 0xffffffffffff16a2ull, 0xffffffffffffffffull };
> +static u64 nist_p224_a[] = { 0xfffffffeull, 0xffffffffffffffffull,
> + 0xfffffffffffffffeull, 0xffffffffffffffffull };
> +static u64 nist_p224_b[] = { 0x2355ffb4ull, 0xd7bfd8ba270b3943ull,
> + 0xf54132565044b0b7ull, 0xb4050a850c04b3abull };
> +static struct ecc_curve nist_p224 = {
> + .name = "nist_224",
> + .nbits = 224,
> + .g = {
> + .x = nist_p224_g_x,
> + .y = nist_p224_g_y,
> + .ndigits = 4,
> + },
> + .p = nist_p224_p,
> + .n = nist_p224_n,
> + .a = nist_p224_a,
> + .b = nist_p224_b
> +};
> +
> /* NIST P-256: a = p - 3 */
> static u64 nist_p256_g_x[] = { 0xF4A13945D898C296ull, 0x77037D812DEB33A0ull,
> 0xF8BCE6E563A440F2ull, 0x6B17D1F2E12C4247ull };
> diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
> index 9784ecdd2fb4..07e0d3058f5f 100644
> --- a/include/crypto/ecdh.h
> +++ b/include/crypto/ecdh.h
> @@ -24,9 +24,10 @@
>
> /* Curves IDs */
> #define ECC_CURVE_NIST_P192 0x0001
> -#define ECC_CURVE_NIST_P256 0x0002
> -#define ECC_CURVE_NIST_P384 0x0003
> -#define ECC_CURVE_NIST_P521 0x0004
> +#define ECC_CURVE_NIST_P224 0x0002
> +#define ECC_CURVE_NIST_P256 0x0003
> +#define ECC_CURVE_NIST_P384 0x0004
> +#define ECC_CURVE_NIST_P521 0x0005
>
> /**
> * struct ecdh - define an ECDH private key
>
> ---
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
> change-id: 20260729-add-nist-p224-curve-8612b49d6ba2
>
> Best regards,
> --
> Paul Louvel, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters
2026-07-29 15:51 [PATCH] crypto: ecc - Add NIST P224 curve parameters Paul Louvel
2026-07-29 16:43 ` Thomas Huth
@ 2026-07-29 16:50 ` Simo Sorce
2026-07-29 18:28 ` Lukas Wunner
2 siblings, 0 replies; 6+ messages in thread
From: Simo Sorce @ 2026-07-29 16:50 UTC (permalink / raw)
To: Paul Louvel, Lukas Wunner, Ignat Korchagin, Stefan Berger,
Herbert Xu, David S. Miller
Cc: linux-crypto, linux-kernel, Thomas Petazzoni
On Wed, 2026-07-29 at 17:51 +0200, Paul Louvel wrote:
> Add the parameters for the NIST P224 curve and define a new curve ID for
> it. Make the curve available in ecc_get_curve().
P224 is very weak and generally a bad idea to start using such keys
now, why is this needed?
Simo.
--
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters
2026-07-29 15:51 [PATCH] crypto: ecc - Add NIST P224 curve parameters Paul Louvel
2026-07-29 16:43 ` Thomas Huth
2026-07-29 16:50 ` Simo Sorce
@ 2026-07-29 18:28 ` Lukas Wunner
2 siblings, 0 replies; 6+ messages in thread
From: Lukas Wunner @ 2026-07-29 18:28 UTC (permalink / raw)
To: Paul Louvel
Cc: Ignat Korchagin, Stefan Berger, Herbert Xu, David S. Miller,
linux-crypto, linux-kernel, Thomas Petazzoni
On Wed, Jul 29, 2026 at 05:51:04PM +0200, Paul Louvel wrote:
> Add the parameters for the NIST P224 curve and define a new curve ID for
> it. Make the curve available in ecc_get_curve().
Usually we'd also want test vectors in crypto/testmgr.h.
> +static struct ecc_curve nist_p224 = {
> + .name = "nist_224",
> + .nbits = 224,
> + .g = {
> + .x = nist_p224_g_x,
> + .y = nist_p224_g_y,
> + .ndigits = 4,
This should be 3 because DIV_ROUND_UP(224, 64) = 3.
Thanks,
Lukas
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters
2026-07-29 16:43 ` Thomas Huth
@ 2026-07-29 19:06 ` Paul Louvel
2026-07-29 19:37 ` Simo Sorce
0 siblings, 1 reply; 6+ messages in thread
From: Paul Louvel @ 2026-07-29 19:06 UTC (permalink / raw)
To: Thomas Huth, Lukas Wunner, Ignat Korchagin, Stefan Berger,
Herbert Xu, David S. Miller, Simo Sorce
Cc: linux-crypto, linux-kernel, Thomas Petazzoni
Hi Thomas, Simo,
On Wed Jul 29, 2026 at 6:43 PM CEST, Thomas Huth wrote:
> On 29/07/2026 17.51, Paul Louvel wrote:
>> Add the parameters for the NIST P224 curve and define a new curve ID for
>> it. Make the curve available in ecc_get_curve().
>
> May I ask: Who's going to consume this?
I am in charge of upstreaming the ECDSA and ECDH support of a PKA device. The
downstream driver is using the NIST P224 curve in it's code internally.
We are waiting approval to upstream the driver, and I took the initiative to
send the curve definition ahead of time, as I thought it might be better to have
this definition in the core rather than in the driver itself.
This is an old IP that is more than 10 years old, and seeing Simo Sorce's
comment, it might not be a good idea to use this curve anymore.
>
> Thomas
>
>> Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
>> ---
>> crypto/ecc.c | 2 ++
>> crypto/ecc_curve_defs.h | 27 +++++++++++++++++++++++++++
>> include/crypto/ecdh.h | 7 ++++---
>> 3 files changed, 33 insertions(+), 3 deletions(-)
>>
>> diff --git a/crypto/ecc.c b/crypto/ecc.c
>> index 6eb4d97a5f0d..6aa007420ab4 100644
>> --- a/crypto/ecc.c
>> +++ b/crypto/ecc.c
>> @@ -56,6 +56,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
>> /* In FIPS mode only allow P256 and higher */
>> case ECC_CURVE_NIST_P192:
>> return fips_enabled ? NULL : &nist_p192;
>> + case ECC_CURVE_NIST_P224:
>> + return &nist_p224;
>> case ECC_CURVE_NIST_P256:
>> return &nist_p256;
>> case ECC_CURVE_NIST_P384:
>> diff --git a/crypto/ecc_curve_defs.h b/crypto/ecc_curve_defs.h
>> index 0ecade7d02f5..c67b73f2cd5a 100644
>> --- a/crypto/ecc_curve_defs.h
>> +++ b/crypto/ecc_curve_defs.h
>> @@ -29,6 +29,33 @@ static struct ecc_curve nist_p192 = {
>> .b = nist_p192_b
>> };
>>
>> +/* NIST P-224: a = p - 3 */
>> +static u64 nist_p224_g_x[] = { 0x115c1d21ull, 0x56c21122343280d6ull,
>> + 0x321390b94a03c1d3ull, 0xb70e0cbd6bb4bf7full };
>> +static u64 nist_p224_g_y[] = { 0x85007e34ull, 0x5a07476444d58199ull,
>> + 0x4c22dfe6cd4375a0ull, 0xbd376388b5f723fbull };
>> +static u64 nist_p224_p[] = { 0x00000001ull, 0x0000000000000000ull,
>> + 0xffffffffffffffffull, 0xffffffffffffffffull };
>> +static u64 nist_p224_n[] = { 0x5c5c2a3dull, 0xe0b8f03e13dd2945ull,
>> + 0xffffffffffff16a2ull, 0xffffffffffffffffull };
>> +static u64 nist_p224_a[] = { 0xfffffffeull, 0xffffffffffffffffull,
>> + 0xfffffffffffffffeull, 0xffffffffffffffffull };
>> +static u64 nist_p224_b[] = { 0x2355ffb4ull, 0xd7bfd8ba270b3943ull,
>> + 0xf54132565044b0b7ull, 0xb4050a850c04b3abull };
>> +static struct ecc_curve nist_p224 = {
>> + .name = "nist_224",
>> + .nbits = 224,
>> + .g = {
>> + .x = nist_p224_g_x,
>> + .y = nist_p224_g_y,
>> + .ndigits = 4,
>> + },
>> + .p = nist_p224_p,
>> + .n = nist_p224_n,
>> + .a = nist_p224_a,
>> + .b = nist_p224_b
>> +};
>> +
>> /* NIST P-256: a = p - 3 */
>> static u64 nist_p256_g_x[] = { 0xF4A13945D898C296ull, 0x77037D812DEB33A0ull,
>> 0xF8BCE6E563A440F2ull, 0x6B17D1F2E12C4247ull };
>> diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
>> index 9784ecdd2fb4..07e0d3058f5f 100644
>> --- a/include/crypto/ecdh.h
>> +++ b/include/crypto/ecdh.h
>> @@ -24,9 +24,10 @@
>>
>> /* Curves IDs */
>> #define ECC_CURVE_NIST_P192 0x0001
>> -#define ECC_CURVE_NIST_P256 0x0002
>> -#define ECC_CURVE_NIST_P384 0x0003
>> -#define ECC_CURVE_NIST_P521 0x0004
>> +#define ECC_CURVE_NIST_P224 0x0002
>> +#define ECC_CURVE_NIST_P256 0x0003
>> +#define ECC_CURVE_NIST_P384 0x0004
>> +#define ECC_CURVE_NIST_P521 0x0005
>>
>> /**
>> * struct ecdh - define an ECDH private key
>>
>> ---
>> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
>> change-id: 20260729-add-nist-p224-curve-8612b49d6ba2
>>
>> Best regards,
>> --
>> Paul Louvel, Bootlin
>> Embedded Linux and Kernel engineering
>> https://bootlin.com
>>
>>
Thanks,
--
Paul Louvel, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters
2026-07-29 19:06 ` Paul Louvel
@ 2026-07-29 19:37 ` Simo Sorce
0 siblings, 0 replies; 6+ messages in thread
From: Simo Sorce @ 2026-07-29 19:37 UTC (permalink / raw)
To: Paul Louvel, Thomas Huth, Lukas Wunner, Ignat Korchagin,
Stefan Berger, Herbert Xu, David S. Miller
Cc: linux-crypto, linux-kernel, Thomas Petazzoni
On Wed, 2026-07-29 at 21:06 +0200, Paul Louvel wrote:
> Hi Thomas, Simo,
>
> On Wed Jul 29, 2026 at 6:43 PM CEST, Thomas Huth wrote:
> > On 29/07/2026 17.51, Paul Louvel wrote:
> >> Add the parameters for the NIST P224 curve and define a new curve ID for
> >> it. Make the curve available in ecc_get_curve().
> >
> > May I ask: Who's going to consume this?
>
> I am in charge of upstreaming the ECDSA and ECDH support of a PKA device. The
> downstream driver is using the NIST P224 curve in it's code internally.
> We are waiting approval to upstream the driver, and I took the initiative to
> send the curve definition ahead of time, as I thought it might be better to have
> this definition in the core rather than in the driver itself.
>
> This is an old IP that is more than 10 years old, and seeing Simo Sorce's
> comment, it might not be a good idea to use this curve anymore.
I would simply not expose P224 at all, nothing should use it anyway.
Simo.
--
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-07-29 19:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-29 15:51 [PATCH] crypto: ecc - Add NIST P224 curve parameters Paul Louvel
2026-07-29 16:43 ` Thomas Huth
2026-07-29 19:06 ` Paul Louvel
2026-07-29 19:37 ` Simo Sorce
2026-07-29 16:50 ` Simo Sorce
2026-07-29 18:28 ` Lukas Wunner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox