From 8b8c021a911dc4220ee9e5b09b25c704daa0787d Mon Sep 17 00:00:00 2001
From: Tete17 <miguel_tete17@hotmail.com>
Date: Tue, 14 Apr 2026 00:00:47 +0200
Subject: [PATCH] LibCrypto: Support EC compressed point format (0x02/0x03)

Add SECPxxxr1Point::from_compressed() to decompress SEC 1 compressed
EC public keys using OpenSSL's EC_POINT_oct2point. Refactor
read_ec_public_key() to delegate to SECPxxxr1Point::from_uncompressed
and from_compressed, removing duplicated parsing logic.
---
 Libraries/LibCrypto/Curves/SECPxxxr1.cpp | 43 +++++++++++++
 Libraries/LibCrypto/Curves/SECPxxxr1.h   |  7 +-
 Libraries/LibCrypto/PK/EC.cpp            | 48 ++------------
 Tests/LibCrypto/TestCurves.cpp           | 82 ++++++++++++++++++++++++
 4 files changed, 135 insertions(+), 45 deletions(-)

diff --git a/Libraries/LibCrypto/Curves/SECPxxxr1.cpp b/Libraries/LibCrypto/Curves/SECPxxxr1.cpp
index aa31a2a024..513ec1928a 100644
--- a/Libraries/LibCrypto/Curves/SECPxxxr1.cpp
+++ b/Libraries/LibCrypto/Curves/SECPxxxr1.cpp
@@ -14,6 +14,49 @@
 
 namespace Crypto::Curves {
 
+static char const* curve_name_for_scalar_size(size_t scalar_size)
+{
+    switch (scalar_size) {
+    case 32:
+        return "P-256";
+    case 48:
+        return "P-384";
+    case 66:
+        return "P-521";
+    default:
+        return nullptr;
+    }
+}
+
+ErrorOr<SECPxxxr1Point> SECPxxxr1Point::from_compressed(ReadonlyBytes data)
+{
+    if (data.size() < 2 || (data[0] != 0x02 && data[0] != 0x03))
+        return Error::from_string_literal("Invalid compressed EC point");
+
+    auto scalar_size = data.size() - 1;
+    auto const* curve = curve_name_for_scalar_size(scalar_size);
+    if (!curve)
+        return Error::from_string_literal("Unsupported curve for compressed EC point");
+
+    auto* group = OPENSSL_TRY_PTR(EC_GROUP_new_by_curve_name(EC_curve_nist2nid(curve)));
+    ScopeGuard const free_group = [&] { EC_GROUP_free(group); };
+
+    auto* point = OPENSSL_TRY_PTR(EC_POINT_new(group));
+    ScopeGuard const free_point = [&] { EC_POINT_free(point); };
+
+    OPENSSL_TRY(EC_POINT_oct2point(group, point, data.data(), data.size(), nullptr));
+
+    auto x = TRY(OpenSSL_BN::create());
+    auto y = TRY(OpenSSL_BN::create());
+    OPENSSL_TRY(EC_POINT_get_affine_coordinates(group, point, x.ptr(), y.ptr(), nullptr));
+
+    return SECPxxxr1Point {
+        TRY(openssl_bignum_to_unsigned_big_integer(x)),
+        TRY(openssl_bignum_to_unsigned_big_integer(y)),
+        scalar_size,
+    };
+}
+
 ErrorOr<UnsignedBigInteger> SECPxxxr1::generate_private_key()
 {
     auto key = TRY(OpenSSL_PKEY::wrap(EVP_PKEY_Q_keygen(nullptr, nullptr, "EC", m_curve_name)));
diff --git a/Libraries/LibCrypto/Curves/SECPxxxr1.h b/Libraries/LibCrypto/Curves/SECPxxxr1.h
index c287b7f9c3..d7b741d967 100644
--- a/Libraries/LibCrypto/Curves/SECPxxxr1.h
+++ b/Libraries/LibCrypto/Curves/SECPxxxr1.h
@@ -44,10 +44,13 @@ struct SECPxxxr1Point {
 
     static ErrorOr<SECPxxxr1Point> from_uncompressed(ReadonlyBytes data)
     {
-        if (data.size() < 1 || data[0] != 0x04)
+        if (data.size() < 3 || data[0] != 0x04)
             return Error::from_string_literal("Invalid length or not an uncompressed SECPxxxr1 point");
 
         auto half_size = (data.size() - 1) / 2;
+        if (1 + half_size * 2 != data.size())
+            return Error::from_string_literal("Invalid uncompressed SECPxxxr1 point length");
+
         return SECPxxxr1Point {
             UnsignedBigInteger::import_data(data.slice(1, half_size)),
             UnsignedBigInteger::import_data(data.slice(1 + half_size, half_size)),
@@ -55,6 +58,8 @@ struct SECPxxxr1Point {
         };
     }
 
+    static ErrorOr<SECPxxxr1Point> from_compressed(ReadonlyBytes data);
+
     ErrorOr<ByteBuffer> x_bytes() const
     {
         return scalar_to_bytes(x, size);
diff --git a/Libraries/LibCrypto/PK/EC.cpp b/Libraries/LibCrypto/PK/EC.cpp
index 60ded0b647..5b7f11e4e2 100644
--- a/Libraries/LibCrypto/PK/EC.cpp
+++ b/Libraries/LibCrypto/PK/EC.cpp
@@ -45,39 +45,6 @@ ErrorOr<ByteBuffer> ECPrivateKey::export_as_der() const
     return encoder.finish();
 }
 
-static ErrorOr<ECPublicKey> decompress_ec_public_key(ReadonlyBytes compressed_bytes, Vector<StringView> current_scope)
-{
-    auto coordinate_size = compressed_bytes.size() - 1;
-    char const* curve_name = nullptr;
-    if (coordinate_size == 32)
-        curve_name = "P-256";
-    else if (coordinate_size == 48)
-        curve_name = "P-384";
-    else if (coordinate_size == 66)
-        curve_name = "P-521";
-    else
-        ERROR_WITH_SCOPE("Unsupported compressed point size");
-
-    auto* group = OPENSSL_TRY_PTR(EC_GROUP_new_by_curve_name(EC_curve_nist2nid(curve_name)));
-    ScopeGuard const free_group = [&] { EC_GROUP_free(group); };
-
-    auto* point = OPENSSL_TRY_PTR(EC_POINT_new(group));
-    ScopeGuard const free_point = [&] { EC_POINT_free(point); };
-
-    OPENSSL_TRY(EC_POINT_oct2point(group, point, compressed_bytes.data(), compressed_bytes.size(), nullptr));
-
-    auto x = TRY(OpenSSL_BN::create());
-    auto y = TRY(OpenSSL_BN::create());
-
-    OPENSSL_TRY(EC_POINT_get_affine_coordinates(group, point, x.ptr(), y.ptr(), nullptr));
-
-    return ::Crypto::PK::ECPublicKey {
-        TRY(openssl_bignum_to_unsigned_big_integer(x)),
-        TRY(openssl_bignum_to_unsigned_big_integer(y)),
-        coordinate_size,
-    };
-}
-
 static ErrorOr<ECPublicKey> read_ec_public_key(ReadonlyBytes bytes, Vector<StringView> current_scope)
 {
     // NOTE: Public keys do not have an ASN1 structure
@@ -86,21 +53,14 @@ static ErrorOr<ECPublicKey> read_ec_public_key(ReadonlyBytes bytes, Vector<Strin
     }
 
     if (bytes[0] == 0x04) {
-        auto half_size = (bytes.size() - 1) / 2;
-        if (1 + half_size * 2 != bytes.size()) {
-            ERROR_WITH_SCOPE("Invalid public key length");
-        }
-
-        return ::Crypto::PK::ECPublicKey {
-            UnsignedBigInteger::import_data(bytes.slice(1, half_size)),
-            UnsignedBigInteger::import_data(bytes.slice(1 + half_size, half_size)),
-            half_size,
-        };
+        auto point = TRY(Curves::SECPxxxr1Point::from_uncompressed(bytes));
+        return ECPublicKey { move(point) };
     }
 
     // Compressed point format: 0x02 (y even) or 0x03 (y odd)
     if (bytes[0] == 0x02 || bytes[0] == 0x03) {
-        return decompress_ec_public_key(bytes, current_scope);
+        auto point = TRY(Curves::SECPxxxr1Point::from_compressed(bytes));
+        return ECPublicKey { move(point) };
     }
 
     if (bytes.size() % 2 == 0) {
diff --git a/Tests/LibCrypto/TestCurves.cpp b/Tests/LibCrypto/TestCurves.cpp
index 00c6c409b4..9018c86ad9 100644
--- a/Tests/LibCrypto/TestCurves.cpp
+++ b/Tests/LibCrypto/TestCurves.cpp
@@ -439,3 +439,85 @@ TEST_CASE(test_secp521r1)
     EXPECT_EQ(expected_public_key.x, generated_public.x);
     EXPECT_EQ(expected_public_key.y, generated_public.y);
 }
+
+// Test vectors from WebCryptoAPI WPT ec_importKey.https.any.js
+TEST_CASE(test_ec_compressed_point_p256)
+{
+    // clang-format off
+    u8 raw_data[] {
+        0x04,
+        0xD2, 0x10, 0xB0, 0xA6, 0xF9, 0xD9, 0xF0, 0x12, 0x86, 0x80, 0x58, 0xB4, 0x3F, 0xA4, 0xF4, 0x71,
+        0x01, 0x85, 0x43, 0xBB, 0xA0, 0x0C, 0x92, 0x50, 0xDF, 0x92, 0x57, 0xC2, 0xAC, 0xAE, 0x5D, 0xD1,
+        0xCE, 0x03, 0x75, 0x52, 0xD4, 0x81, 0x45, 0x0C, 0xE3, 0x9B, 0x4D, 0x10, 0x95, 0x70, 0x1B, 0x17,
+        0x5B, 0xFA, 0xB3, 0x4B, 0x8E, 0x6C, 0x09, 0x9E, 0x18, 0xF1, 0xC1, 0x98, 0x35, 0x83, 0x61, 0xE8,
+    };
+    u8 compressed_data[] {
+        0x02,
+        0xD2, 0x10, 0xB0, 0xA6, 0xF9, 0xD9, 0xF0, 0x12, 0x86, 0x80, 0x58, 0xB4, 0x3F, 0xA4, 0xF4, 0x71,
+        0x01, 0x85, 0x43, 0xBB, 0xA0, 0x0C, 0x92, 0x50, 0xDF, 0x92, 0x57, 0xC2, 0xAC, 0xAE, 0x5D, 0xD1,
+    };
+
+    auto uncompressed = TRY_OR_FAIL(Crypto::Curves::SECPxxxr1Point::from_uncompressed({ raw_data, sizeof(raw_data) }));
+    auto compressed = TRY_OR_FAIL(Crypto::Curves::SECPxxxr1Point::from_compressed({ compressed_data, sizeof(compressed_data) }));
+
+    EXPECT_EQ(uncompressed.x, compressed.x);
+    EXPECT_EQ(uncompressed.y, compressed.y);
+}
+
+TEST_CASE(test_ec_compressed_point_p384)
+{
+    // clang-format off
+    u8 raw_data[] {
+        0x04,
+        0x21, 0x9C, 0x14, 0xD6, 0x66, 0x17, 0xB3, 0x6E, 0xC6, 0xD8, 0x85, 0x6B, 0x38, 0x5B, 0x73, 0xA7,
+        0x4D, 0x34, 0x4F, 0xD8, 0xAE, 0x75, 0xEF, 0x04, 0x64, 0x35, 0xDD, 0xA5, 0x4E, 0x3B, 0x44, 0xBD,
+        0x5F, 0xBD, 0xEB, 0xD1, 0xD0, 0x8D, 0xD6, 0x9E, 0x2D, 0x7D, 0xC1, 0xDC, 0x21, 0x8C, 0xB4, 0x35,
+        0xBD, 0x28, 0x13, 0x8C, 0xC7, 0x78, 0x33, 0x7A, 0x84, 0x2F, 0x6B, 0xD6, 0x1B, 0x24, 0x0E, 0x74,
+        0x24, 0x9F, 0x24, 0x66, 0x7C, 0x2A, 0x58, 0x10, 0xA7, 0x6B, 0xFC, 0x28, 0xE0, 0x33, 0x5F, 0x88,
+        0xA6, 0x50, 0x1D, 0xEC, 0x01, 0x97, 0x6D, 0xA8, 0x5A, 0xFB, 0x00, 0x86, 0x9C, 0xB6, 0xAC, 0xE8,
+    };
+    u8 compressed_data[] {
+        0x02,
+        0x21, 0x9C, 0x14, 0xD6, 0x66, 0x17, 0xB3, 0x6E, 0xC6, 0xD8, 0x85, 0x6B, 0x38, 0x5B, 0x73, 0xA7,
+        0x4D, 0x34, 0x4F, 0xD8, 0xAE, 0x75, 0xEF, 0x04, 0x64, 0x35, 0xDD, 0xA5, 0x4E, 0x3B, 0x44, 0xBD,
+        0x5F, 0xBD, 0xEB, 0xD1, 0xD0, 0x8D, 0xD6, 0x9E, 0x2D, 0x7D, 0xC1, 0xDC, 0x21, 0x8C, 0xB4, 0x35,
+    };
+
+    auto uncompressed = TRY_OR_FAIL(Crypto::Curves::SECPxxxr1Point::from_uncompressed({ raw_data, sizeof(raw_data) }));
+    auto compressed = TRY_OR_FAIL(Crypto::Curves::SECPxxxr1Point::from_compressed({ compressed_data, sizeof(compressed_data) }));
+
+    EXPECT_EQ(uncompressed.x, compressed.x);
+    EXPECT_EQ(uncompressed.y, compressed.y);
+}
+
+TEST_CASE(test_ec_compressed_point_p521)
+{
+    // clang-format off
+    u8 raw_data[] {
+        0x04,
+        0x01, 0x56, 0xF4, 0x79, 0xF8, 0xDF, 0x1E, 0x20, 0xA7, 0xFF, 0xC0, 0x4C, 0xE4, 0x20, 0xC3, 0xE1,
+        0x54, 0xAE, 0x25, 0x19, 0x96, 0xBE, 0xE4, 0x2F, 0x03, 0x4B, 0x84, 0xD4, 0x1B, 0x74, 0x3F, 0x34,
+        0xE4, 0x5F, 0x31, 0x1B, 0x81, 0x3A, 0x9C, 0xDE, 0xC8, 0xCD, 0xA5, 0x9B, 0xBB, 0xBD, 0x31, 0xD4,
+        0x60, 0xB3, 0x29, 0x25, 0x21, 0xE7, 0xC1, 0xB7, 0x22, 0xE5, 0x66, 0x7C, 0x03, 0xDB, 0x2F, 0xAE,
+        0x75, 0x3F,
+        0x01, 0x50, 0x17, 0x36, 0xCF, 0xE2, 0x47, 0x39, 0x43, 0x20, 0xD8, 0xE4, 0xAF, 0xC2, 0xFD, 0x39,
+        0xB5, 0xA9, 0x33, 0x10, 0x61, 0xB8, 0x1E, 0x22, 0x41, 0x28, 0x2B, 0x9E, 0x17, 0x89, 0x18, 0x22,
+        0xB5, 0xB7, 0x9E, 0x05, 0x2F, 0x45, 0x97, 0xB5, 0x96, 0x43, 0xFD, 0x39, 0x37, 0x9C, 0x51, 0xBD,
+        0x51, 0x25, 0xC4, 0xF4, 0x8B, 0xC3, 0xF0, 0x25, 0xCE, 0x3C, 0xD3, 0x69, 0x53, 0x28, 0x6C, 0xCB,
+        0x38, 0xFB,
+    };
+    u8 compressed_data[] {
+        0x03,
+        0x01, 0x56, 0xF4, 0x79, 0xF8, 0xDF, 0x1E, 0x20, 0xA7, 0xFF, 0xC0, 0x4C, 0xE4, 0x20, 0xC3, 0xE1,
+        0x54, 0xAE, 0x25, 0x19, 0x96, 0xBE, 0xE4, 0x2F, 0x03, 0x4B, 0x84, 0xD4, 0x1B, 0x74, 0x3F, 0x34,
+        0xE4, 0x5F, 0x31, 0x1B, 0x81, 0x3A, 0x9C, 0xDE, 0xC8, 0xCD, 0xA5, 0x9B, 0xBB, 0xBD, 0x31, 0xD4,
+        0x60, 0xB3, 0x29, 0x25, 0x21, 0xE7, 0xC1, 0xB7, 0x22, 0xE5, 0x66, 0x7C, 0x03, 0xDB, 0x2F, 0xAE,
+        0x75, 0x3F,
+    };
+
+    auto uncompressed = TRY_OR_FAIL(Crypto::Curves::SECPxxxr1Point::from_uncompressed({ raw_data, sizeof(raw_data) }));
+    auto compressed = TRY_OR_FAIL(Crypto::Curves::SECPxxxr1Point::from_compressed({ compressed_data, sizeof(compressed_data) }));
+
+    EXPECT_EQ(uncompressed.x, compressed.x);
+    EXPECT_EQ(uncompressed.y, compressed.y);
+}