[PATCH] crypto: ecc - Add NIST P224 curve parameters

[PATCH] crypto: ecc - Add NIST P224 curve parameters

[Paul Louvel]

Add the parameters for the NIST P224 curve and define a new curve ID for
it. Make the curve available in ecc_get_curve().

Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
---
 crypto/ecc.c            |  2 ++
 crypto/ecc_curve_defs.h | 27 +++++++++++++++++++++++++++
 include/crypto/ecdh.h   |  7 ++++---
 3 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/crypto/ecc.c b/crypto/ecc.c
index 6eb4d97a5f0d..6aa007420ab4 100644
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -56,6 +56,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
 	/* In FIPS mode only allow P256 and higher */
 	case ECC_CURVE_NIST_P192:
 		return fips_enabled ? NULL : &nist_p192;
+	case ECC_CURVE_NIST_P224:
+		return &nist_p224;
 	case ECC_CURVE_NIST_P256:
 		return &nist_p256;
 	case ECC_CURVE_NIST_P384:
diff --git a/crypto/ecc_curve_defs.h b/crypto/ecc_curve_defs.h
index 0ecade7d02f5..c67b73f2cd5a 100644
--- a/crypto/ecc_curve_defs.h
+++ b/crypto/ecc_curve_defs.h
@@ -29,6 +29,33 @@ static struct ecc_curve nist_p192 = {
 	.b = nist_p192_b
 };
 
+/* NIST P-224: a = p - 3 */
+static u64 nist_p224_g_x[] = { 0x115c1d21ull, 0x56c21122343280d6ull,
+			       0x321390b94a03c1d3ull, 0xb70e0cbd6bb4bf7full };
+static u64 nist_p224_g_y[] = { 0x85007e34ull, 0x5a07476444d58199ull,
+			       0x4c22dfe6cd4375a0ull, 0xbd376388b5f723fbull };
+static u64 nist_p224_p[] = { 0x00000001ull, 0x0000000000000000ull,
+			     0xffffffffffffffffull, 0xffffffffffffffffull };
+static u64 nist_p224_n[] = { 0x5c5c2a3dull, 0xe0b8f03e13dd2945ull,
+			     0xffffffffffff16a2ull, 0xffffffffffffffffull };
+static u64 nist_p224_a[] = { 0xfffffffeull, 0xffffffffffffffffull,
+			     0xfffffffffffffffeull, 0xffffffffffffffffull };
+static u64 nist_p224_b[] = { 0x2355ffb4ull, 0xd7bfd8ba270b3943ull,
+			     0xf54132565044b0b7ull, 0xb4050a850c04b3abull };
+static struct ecc_curve nist_p224 = {
+	.name = "nist_224",
+	.nbits = 224,
+	.g = {
+		.x = nist_p224_g_x,
+		.y = nist_p224_g_y,
+		.ndigits = 4,
+	},
+	.p = nist_p224_p,
+	.n = nist_p224_n,
+	.a = nist_p224_a,
+	.b = nist_p224_b
+};
+
 /* NIST P-256: a = p - 3 */
 static u64 nist_p256_g_x[] = { 0xF4A13945D898C296ull, 0x77037D812DEB33A0ull,
 				0xF8BCE6E563A440F2ull, 0x6B17D1F2E12C4247ull };
diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
index 9784ecdd2fb4..07e0d3058f5f 100644
--- a/include/crypto/ecdh.h
+++ b/include/crypto/ecdh.h
@@ -24,9 +24,10 @@
 
 /* Curves IDs */
 #define ECC_CURVE_NIST_P192	0x0001
-#define ECC_CURVE_NIST_P256	0x0002
-#define ECC_CURVE_NIST_P384	0x0003
-#define ECC_CURVE_NIST_P521	0x0004
+#define ECC_CURVE_NIST_P224	0x0002
+#define ECC_CURVE_NIST_P256	0x0003
+#define ECC_CURVE_NIST_P384	0x0004
+#define ECC_CURVE_NIST_P521	0x0005
 
 /**
  * struct ecdh - define an ECDH private key

---
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
change-id: 20260729-add-nist-p224-curve-8612b49d6ba2

Best regards,
--  
Paul Louvel, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters

[Thomas Huth]

On 29/07/2026 17.51, Paul Louvel wrote:
> Add the parameters for the NIST P224 curve and define a new curve ID for
> it. Make the curve available in ecc_get_curve().

May I ask: Who's going to consume this?

  Thomas

> Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
> ---
>   crypto/ecc.c            |  2 ++
>   crypto/ecc_curve_defs.h | 27 +++++++++++++++++++++++++++
>   include/crypto/ecdh.h   |  7 ++++---
>   3 files changed, 33 insertions(+), 3 deletions(-)
> 
> diff --git a/crypto/ecc.c b/crypto/ecc.c
> index 6eb4d97a5f0d..6aa007420ab4 100644
> --- a/crypto/ecc.c
> +++ b/crypto/ecc.c
> @@ -56,6 +56,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
>   	/* In FIPS mode only allow P256 and higher */
>   	case ECC_CURVE_NIST_P192:
>   		return fips_enabled ? NULL : &nist_p192;
> +	case ECC_CURVE_NIST_P224:
> +		return &nist_p224;
>   	case ECC_CURVE_NIST_P256:
>   		return &nist_p256;
>   	case ECC_CURVE_NIST_P384:
> diff --git a/crypto/ecc_curve_defs.h b/crypto/ecc_curve_defs.h
> index 0ecade7d02f5..c67b73f2cd5a 100644
> --- a/crypto/ecc_curve_defs.h
> +++ b/crypto/ecc_curve_defs.h
> @@ -29,6 +29,33 @@ static struct ecc_curve nist_p192 = {
>   	.b = nist_p192_b
>   };
>   
> +/* NIST P-224: a = p - 3 */
> +static u64 nist_p224_g_x[] = { 0x115c1d21ull, 0x56c21122343280d6ull,
> +			       0x321390b94a03c1d3ull, 0xb70e0cbd6bb4bf7full };
> +static u64 nist_p224_g_y[] = { 0x85007e34ull, 0x5a07476444d58199ull,
> +			       0x4c22dfe6cd4375a0ull, 0xbd376388b5f723fbull };
> +static u64 nist_p224_p[] = { 0x00000001ull, 0x0000000000000000ull,
> +			     0xffffffffffffffffull, 0xffffffffffffffffull };
> +static u64 nist_p224_n[] = { 0x5c5c2a3dull, 0xe0b8f03e13dd2945ull,
> +			     0xffffffffffff16a2ull, 0xffffffffffffffffull };
> +static u64 nist_p224_a[] = { 0xfffffffeull, 0xffffffffffffffffull,
> +			     0xfffffffffffffffeull, 0xffffffffffffffffull };
> +static u64 nist_p224_b[] = { 0x2355ffb4ull, 0xd7bfd8ba270b3943ull,
> +			     0xf54132565044b0b7ull, 0xb4050a850c04b3abull };
> +static struct ecc_curve nist_p224 = {
> +	.name = "nist_224",
> +	.nbits = 224,
> +	.g = {
> +		.x = nist_p224_g_x,
> +		.y = nist_p224_g_y,
> +		.ndigits = 4,
> +	},
> +	.p = nist_p224_p,
> +	.n = nist_p224_n,
> +	.a = nist_p224_a,
> +	.b = nist_p224_b
> +};
> +
>   /* NIST P-256: a = p - 3 */
>   static u64 nist_p256_g_x[] = { 0xF4A13945D898C296ull, 0x77037D812DEB33A0ull,
>   				0xF8BCE6E563A440F2ull, 0x6B17D1F2E12C4247ull };
> diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
> index 9784ecdd2fb4..07e0d3058f5f 100644
> --- a/include/crypto/ecdh.h
> +++ b/include/crypto/ecdh.h
> @@ -24,9 +24,10 @@
>   
>   /* Curves IDs */
>   #define ECC_CURVE_NIST_P192	0x0001
> -#define ECC_CURVE_NIST_P256	0x0002
> -#define ECC_CURVE_NIST_P384	0x0003
> -#define ECC_CURVE_NIST_P521	0x0004
> +#define ECC_CURVE_NIST_P224	0x0002
> +#define ECC_CURVE_NIST_P256	0x0003
> +#define ECC_CURVE_NIST_P384	0x0004
> +#define ECC_CURVE_NIST_P521	0x0005
>   
>   /**
>    * struct ecdh - define an ECDH private key
> 
> ---
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
> change-id: 20260729-add-nist-p224-curve-8612b49d6ba2
> 
> Best regards,
> --
> Paul Louvel, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
> 
> 

Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters

[Paul Louvel]

Hi Thomas, Simo,

On Wed Jul 29, 2026 at 6:43 PM CEST, Thomas Huth wrote:
 > On 29/07/2026 17.51, Paul Louvel wrote:
 >> Add the parameters for the NIST P224 curve and define a new curve ID for
 >> it. Make the curve available in ecc_get_curve().
 >
 > May I ask: Who's going to consume this?

I am in charge of upstreaming the ECDSA and ECDH support of a PKA device. The
downstream driver is using the NIST P224 curve in it's code internally.
We are waiting approval to upstream the driver, and I took the initiative to
send the curve definition ahead of time, as I thought it might be better to have
this definition in the core rather than in the driver itself.

This is an old IP that is more than 10 years old, and seeing Simo Sorce's
comment, it might not be a good idea to use this curve anymore.

 >
 >   Thomas
 >
 >> Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
 >> ---
 >>   crypto/ecc.c            |  2 ++
 >>   crypto/ecc_curve_defs.h | 27 +++++++++++++++++++++++++++
 >>   include/crypto/ecdh.h   |  7 ++++---
 >>   3 files changed, 33 insertions(+), 3 deletions(-)
 >>
 >> diff --git a/crypto/ecc.c b/crypto/ecc.c
 >> index 6eb4d97a5f0d..6aa007420ab4 100644
 >> --- a/crypto/ecc.c
 >> +++ b/crypto/ecc.c
 >> @@ -56,6 +56,8 @@ const struct ecc_curve *ecc_get_curve(unsigned int curve_id)
 >>       /* In FIPS mode only allow P256 and higher */
 >>       case ECC_CURVE_NIST_P192:
 >>           return fips_enabled ? NULL : &nist_p192;
 >> +    case ECC_CURVE_NIST_P224:
 >> +        return &nist_p224;
 >>       case ECC_CURVE_NIST_P256:
 >>           return &nist_p256;
 >>       case ECC_CURVE_NIST_P384:
 >> diff --git a/crypto/ecc_curve_defs.h b/crypto/ecc_curve_defs.h
 >> index 0ecade7d02f5..c67b73f2cd5a 100644
 >> --- a/crypto/ecc_curve_defs.h
 >> +++ b/crypto/ecc_curve_defs.h
 >> @@ -29,6 +29,33 @@ static struct ecc_curve nist_p192 = {
 >>       .b = nist_p192_b
 >>   };
 >>
 >> +/* NIST P-224: a = p - 3 */
 >> +static u64 nist_p224_g_x[] = { 0x115c1d21ull, 0x56c21122343280d6ull,
 >> +                   0x321390b94a03c1d3ull, 0xb70e0cbd6bb4bf7full };
 >> +static u64 nist_p224_g_y[] = { 0x85007e34ull, 0x5a07476444d58199ull,
 >> +                   0x4c22dfe6cd4375a0ull, 0xbd376388b5f723fbull };
 >> +static u64 nist_p224_p[] = { 0x00000001ull, 0x0000000000000000ull,
 >> +                 0xffffffffffffffffull, 0xffffffffffffffffull };
 >> +static u64 nist_p224_n[] = { 0x5c5c2a3dull, 0xe0b8f03e13dd2945ull,
 >> +                 0xffffffffffff16a2ull, 0xffffffffffffffffull };
 >> +static u64 nist_p224_a[] = { 0xfffffffeull, 0xffffffffffffffffull,
 >> +                 0xfffffffffffffffeull, 0xffffffffffffffffull };
 >> +static u64 nist_p224_b[] = { 0x2355ffb4ull, 0xd7bfd8ba270b3943ull,
 >> +                 0xf54132565044b0b7ull, 0xb4050a850c04b3abull };
 >> +static struct ecc_curve nist_p224 = {
 >> +    .name = "nist_224",
 >> +    .nbits = 224,
 >> +    .g = {
 >> +        .x = nist_p224_g_x,
 >> +        .y = nist_p224_g_y,
 >> +        .ndigits = 4,
 >> +    },
 >> +    .p = nist_p224_p,
 >> +    .n = nist_p224_n,
 >> +    .a = nist_p224_a,
 >> +    .b = nist_p224_b
 >> +};
 >> +
 >>   /* NIST P-256: a = p - 3 */
 >>   static u64 nist_p256_g_x[] = { 0xF4A13945D898C296ull, 0x77037D812DEB33A0ull,
 >>                   0xF8BCE6E563A440F2ull, 0x6B17D1F2E12C4247ull };
 >> diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
 >> index 9784ecdd2fb4..07e0d3058f5f 100644
 >> --- a/include/crypto/ecdh.h
 >> +++ b/include/crypto/ecdh.h
 >> @@ -24,9 +24,10 @@
 >>
 >>   /* Curves IDs */
 >>   #define ECC_CURVE_NIST_P192    0x0001
 >> -#define ECC_CURVE_NIST_P256    0x0002
 >> -#define ECC_CURVE_NIST_P384    0x0003
 >> -#define ECC_CURVE_NIST_P521    0x0004
 >> +#define ECC_CURVE_NIST_P224    0x0002
 >> +#define ECC_CURVE_NIST_P256    0x0003
 >> +#define ECC_CURVE_NIST_P384    0x0004
 >> +#define ECC_CURVE_NIST_P521    0x0005
 >>
 >>   /**
 >>    * struct ecdh - define an ECDH private key
 >>
 >> ---
 >> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
 >> change-id: 20260729-add-nist-p224-curve-8612b49d6ba2
 >>
 >> Best regards,
 >> --
 >> Paul Louvel, Bootlin
 >> Embedded Linux and Kernel engineering
 >> https://bootlin.com
 >>
 >>

Thanks,




-- 
Paul Louvel, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters

[Simo Sorce]

On Wed, 2026-07-29 at 21:06 +0200, Paul Louvel wrote:
> Hi Thomas, Simo,
> 
> On Wed Jul 29, 2026 at 6:43 PM CEST, Thomas Huth wrote:
>  > On 29/07/2026 17.51, Paul Louvel wrote:
>  >> Add the parameters for the NIST P224 curve and define a new curve ID for
>  >> it. Make the curve available in ecc_get_curve().
>  >
>  > May I ask: Who's going to consume this?
> 
> I am in charge of upstreaming the ECDSA and ECDH support of a PKA device. The
> downstream driver is using the NIST P224 curve in it's code internally.
> We are waiting approval to upstream the driver, and I took the initiative to
> send the curve definition ahead of time, as I thought it might be better to have
> this definition in the core rather than in the driver itself.
> 
> This is an old IP that is more than 10 years old, and seeing Simo Sorce's
> comment, it might not be a good idea to use this curve anymore.

I would simply not expose P224 at all, nothing should use it anyway.

Simo.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc

Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters

[Simo Sorce]

On Wed, 2026-07-29 at 17:51 +0200, Paul Louvel wrote:
> Add the parameters for the NIST P224 curve and define a new curve ID for
> it. Make the curve available in ecc_get_curve().

P224 is very weak and generally a bad idea to start using such keys
now, why is this needed?

Simo.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc

Re: [PATCH] crypto: ecc - Add NIST P224 curve parameters

[Lukas Wunner]

On Wed, Jul 29, 2026 at 05:51:04PM +0200, Paul Louvel wrote:
> Add the parameters for the NIST P224 curve and define a new curve ID for
> it. Make the curve available in ecc_get_curve().

Usually we'd also want test vectors in crypto/testmgr.h.

> +static struct ecc_curve nist_p224 = {
> +	.name = "nist_224",
> +	.nbits = 224,
> +	.g = {
> +		.x = nist_p224_g_x,
> +		.y = nist_p224_g_y,
> +		.ndigits = 4,

This should be 3 because DIV_ROUND_UP(224, 64) = 3.

Thanks,

Lukas