diff -up openssl-1.1.1c/Configurations/00-base-templates.conf.s390x-ecc openssl-1.1.1c/Configurations/00-base-templates.conf

--- openssl-1.1.1c/Configurations/00-base-templates.conf.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/Configurations/00-base-templates.conf	2019-11-20 11:36:02.190860451 +0100

@@ -289,6 +289,7 @@ my %targets=(

 	template	=> 1,

 	cpuid_asm_src   => "s390xcap.c s390xcpuid.S",

 	bn_asm_src      => "asm/s390x.S s390x-mont.S s390x-gf2m.s",

+	ec_asm_src      => "ecp_s390x_nistp.c",

 	aes_asm_src     => "aes-s390x.S aes-ctr.fake aes-xts.fake",

 	sha1_asm_src    => "sha1-s390x.S sha256-s390x.S sha512-s390x.S",

 	rc4_asm_src     => "rc4-s390x.s",

diff -up openssl-1.1.1c/Configure.s390x-ecc openssl-1.1.1c/Configure

--- openssl-1.1.1c/Configure.s390x-ecc	2019-11-20 11:36:02.078862415 +0100

+++ openssl-1.1.1c/Configure	2019-11-20 11:36:02.191860433 +0100

@@ -1410,6 +1410,9 @@ unless ($disabled{asm}) {

     if ($target{ec_asm_src} =~ /ecp_nistz256/) {

         push @{$config{lib_defines}}, "ECP_NISTZ256_ASM";

     }

+    if ($target{ec_asm_src} =~ /ecp_s390x_nistp/) {

+        push @{$config{lib_defines}}, "S390X_EC_ASM";

+    }

     if ($target{ec_asm_src} =~ /x25519/) {

         push @{$config{lib_defines}}, "X25519_ASM";

     }

diff -up openssl-1.1.1c/crypto/bn/asm/s390x.S.s390x-ecc openssl-1.1.1c/crypto/bn/asm/s390x.S

--- openssl-1.1.1c/crypto/bn/asm/s390x.S.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/bn/asm/s390x.S	2019-11-20 11:36:02.191860433 +0100

@@ -511,7 +511,7 @@ bn_mul_comba4:

 	lghi	zero,0

 	mul_add_c(0,0,c1,c2,c3);

-	stg	c1,0*8(%r3)

+	stg	c1,0*8(%r2)

 	lghi	c1,0

 	mul_add_c(0,1,c2,c3,c1);

diff -up openssl-1.1.1c/crypto/cmac/cm_pmeth.c.s390x-ecc openssl-1.1.1c/crypto/cmac/cm_pmeth.c

--- openssl-1.1.1c/crypto/cmac/cm_pmeth.c.s390x-ecc	2019-11-20 11:36:02.078862415 +0100

+++ openssl-1.1.1c/crypto/cmac/cm_pmeth.c	2019-11-20 11:36:02.191860433 +0100

@@ -159,3 +159,8 @@ const EVP_PKEY_METHOD cmac_pkey_meth = {

     pkey_cmac_ctrl,

     pkey_cmac_ctrl_str

 };

+

+const EVP_PKEY_METHOD *cmac_pkey_method(void)

+{

+    return &cmac_pkey_meth;

+}

diff -up openssl-1.1.1c/crypto/dh/dh_pmeth.c.s390x-ecc openssl-1.1.1c/crypto/dh/dh_pmeth.c

--- openssl-1.1.1c/crypto/dh/dh_pmeth.c.s390x-ecc	2019-11-20 11:36:02.079862397 +0100

+++ openssl-1.1.1c/crypto/dh/dh_pmeth.c	2019-11-20 11:36:02.191860433 +0100

@@ -512,6 +512,11 @@ const EVP_PKEY_METHOD dh_pkey_meth = {

     pkey_dh_ctrl_str

 };

+const EVP_PKEY_METHOD *dh_pkey_method(void)

+{

+    return &dh_pkey_meth;

+}

+

 const EVP_PKEY_METHOD dhx_pkey_meth = {

     EVP_PKEY_DHX,

     EVP_PKEY_FLAG_FIPS,

@@ -545,3 +550,8 @@ const EVP_PKEY_METHOD dhx_pkey_meth = {

     pkey_dh_ctrl,

     pkey_dh_ctrl_str

 };

+

+const EVP_PKEY_METHOD *dhx_pkey_method(void)

+{

+    return &dhx_pkey_meth;

+}

diff -up openssl-1.1.1c/crypto/dsa/dsa_pmeth.c.s390x-ecc openssl-1.1.1c/crypto/dsa/dsa_pmeth.c

--- openssl-1.1.1c/crypto/dsa/dsa_pmeth.c.s390x-ecc	2019-11-20 11:36:02.100862029 +0100

+++ openssl-1.1.1c/crypto/dsa/dsa_pmeth.c	2019-11-20 11:36:02.191860433 +0100

@@ -275,3 +275,8 @@ const EVP_PKEY_METHOD dsa_pkey_meth = {

     pkey_dsa_ctrl,

     pkey_dsa_ctrl_str

 };

+

+const EVP_PKEY_METHOD *dsa_pkey_method(void)

+{

+    return &dsa_pkey_meth;

+}

diff -up openssl-1.1.1c/crypto/ec/build.info.s390x-ecc openssl-1.1.1c/crypto/ec/build.info

--- openssl-1.1.1c/crypto/ec/build.info.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/build.info	2019-11-20 11:36:02.192860416 +0100

@@ -26,6 +26,9 @@ GENERATE[ecp_nistz256-armv8.S]=asm/ecp_n

 INCLUDE[ecp_nistz256-armv8.o]=..

 GENERATE[ecp_nistz256-ppc64.s]=asm/ecp_nistz256-ppc64.pl $(PERLASM_SCHEME)

+INCLUDE[ecp_s390x_nistp.o]=..

+INCLUDE[ecx_meth.o]=..

+

 GENERATE[x25519-x86_64.s]=asm/x25519-x86_64.pl $(PERLASM_SCHEME)

 GENERATE[x25519-ppc64.s]=asm/x25519-ppc64.pl $(PERLASM_SCHEME)

diff -up openssl-1.1.1c/crypto/ec/ec_curve.c.s390x-ecc openssl-1.1.1c/crypto/ec/ec_curve.c

--- openssl-1.1.1c/crypto/ec/ec_curve.c.s390x-ecc	2019-11-20 11:36:02.043863029 +0100

+++ openssl-1.1.1c/crypto/ec/ec_curve.c	2019-11-20 11:36:02.192860416 +0100

@@ -255,20 +255,29 @@ static const ec_list_element curve_list[

     {NID_secp256k1, &_EC_SECG_PRIME_256K1.h, 0,

      "SECG curve over a 256 bit prime field"},

     /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */

-    {NID_secp384r1, &_EC_NIST_PRIME_384.h, 0,

+    {NID_secp384r1, &_EC_NIST_PRIME_384.h,

+# if defined(S390X_EC_ASM)

+     EC_GFp_s390x_nistp384_method,

+# else

+     0,

+# endif

      "NIST/SECG curve over a 384 bit prime field"},

-#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128

-    {NID_secp521r1, &_EC_NIST_PRIME_521.h, EC_GFp_nistp521_method,

-     "NIST/SECG curve over a 521 bit prime field"},

-#else

-    {NID_secp521r1, &_EC_NIST_PRIME_521.h, 0,

+    {NID_secp521r1, &_EC_NIST_PRIME_521.h,

+# if defined(S390X_EC_ASM)

+     EC_GFp_s390x_nistp521_method,

+# elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128)

+     EC_GFp_nistp521_method,

+# else

+     0,

+# endif

      "NIST/SECG curve over a 521 bit prime field"},

-#endif

     /* X9.62 curves */

     {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h,

 #if defined(ECP_NISTZ256_ASM)

      EC_GFp_nistz256_method,

-#elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128)

+# elif defined(S390X_EC_ASM)

+     EC_GFp_s390x_nistp256_method,

+# elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128)

      EC_GFp_nistp256_method,

 #else

      0,

diff -up openssl-1.1.1c/crypto/ec/ecdsa_ossl.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecdsa_ossl.c

--- openssl-1.1.1c/crypto/ec/ecdsa_ossl.c.s390x-ecc	2019-11-20 11:36:02.100862029 +0100

+++ openssl-1.1.1c/crypto/ec/ecdsa_ossl.c	2019-11-20 11:36:02.192860416 +0100

@@ -18,6 +18,41 @@

 # include <openssl/fips.h>

 #endif

+int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,

+                          BIGNUM **rp)

+{

+    if (eckey->group->meth->ecdsa_sign_setup == NULL) {

+        ECerr(EC_F_OSSL_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA);

+        return 0;

+    }

+

+    return eckey->group->meth->ecdsa_sign_setup(eckey, ctx_in, kinvp, rp);

+}

+

+ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,

+                               const BIGNUM *in_kinv, const BIGNUM *in_r,

+                               EC_KEY *eckey)

+{

+    if (eckey->group->meth->ecdsa_sign_sig == NULL) {

+        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA);

+        return NULL;

+    }

+

+    return eckey->group->meth->ecdsa_sign_sig(dgst, dgst_len,

+                                              in_kinv, in_r, eckey);

+}

+

+int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,

+                          const ECDSA_SIG *sig, EC_KEY *eckey)

+{

+    if (eckey->group->meth->ecdsa_verify_sig == NULL) {

+        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA);

+        return 0;

+    }

+

+    return eckey->group->meth->ecdsa_verify_sig(dgst, dgst_len, sig, eckey);

+}

+

 int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen,

                     unsigned char *sig, unsigned int *siglen,

                     const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey)

@@ -145,15 +180,15 @@ static int ecdsa_sign_setup(EC_KEY *ecke

     return ret;

 }

-int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,

-                          BIGNUM **rp)

+int ecdsa_simple_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,

+                            BIGNUM **rp)

 {

     return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0);

 }

-ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,

-                               const BIGNUM *in_kinv, const BIGNUM *in_r,

-                               EC_KEY *eckey)

+ECDSA_SIG *ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len,

+                                 const BIGNUM *in_kinv, const BIGNUM *in_r,

+                                 EC_KEY *eckey)

 {

     int ok = 0, i;

     BIGNUM *kinv = NULL, *s, *m = NULL;

@@ -210,25 +245,25 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const uns

     if (8 * dgst_len > i)

         dgst_len = (i + 7) / 8;

     if (!BN_bin2bn(dgst, dgst_len, m)) {

-        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB);

         goto err;

     }

     /* If still too long, truncate remaining bits with a shift */

     if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {

-        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB);

         goto err;

     }

     do {

         if (in_kinv == NULL || in_r == NULL) {

             if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) {

-                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB);

+                ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_ECDSA_LIB);

                 goto err;

             }

             ckinv = kinv;

         } else {

             ckinv = in_kinv;

             if (BN_copy(ret->r, in_r) == NULL) {

-                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);

+                ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_MALLOC_FAILURE);

                 goto err;

             }

         }

@@ -242,11 +277,11 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const uns

          */

         if (!bn_to_mont_fixed_top(s, ret->r, group->mont_data, ctx)

             || !bn_mul_mont_fixed_top(s, s, priv_key, group->mont_data, ctx)) {

-            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);

+            ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB);

             goto err;

         }

         if (!bn_mod_add_fixed_top(s, s, m, order)) {

-            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);

+            ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB);

             goto err;

         }

         /*

@@ -255,7 +290,7 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const uns

          */

         if (!bn_to_mont_fixed_top(s, s, group->mont_data, ctx)

             || !BN_mod_mul_montgomery(s, s, ckinv, group->mont_data, ctx)) {

-            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);

+            ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, ERR_R_BN_LIB);

             goto err;

         }

@@ -265,7 +300,7 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const uns

              * generate new kinv and r values

              */

             if (in_kinv != NULL && in_r != NULL) {

-                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES);

+                ECerr(EC_F_ECDSA_SIMPLE_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES);

                 goto err;

             }

         } else {

@@ -317,8 +352,8 @@ int ossl_ecdsa_verify(int type, const un

     return ret;

 }

-int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,

-                          const ECDSA_SIG *sig, EC_KEY *eckey)

+int ecdsa_simple_verify_sig(const unsigned char *dgst, int dgst_len,

+                            const ECDSA_SIG *sig, EC_KEY *eckey)

 {

     int ret = -1, i;

     BN_CTX *ctx;

@@ -338,18 +373,18 @@ int ossl_ecdsa_verify_sig(const unsigned

     /* check input values */

     if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||

         (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_MISSING_PARAMETERS);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, EC_R_MISSING_PARAMETERS);

         return -1;

     }

     if (!EC_KEY_can_sign(eckey)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);

         return -1;

     }

     ctx = BN_CTX_new();

     if (ctx == NULL) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_MALLOC_FAILURE);

         return -1;

     }

     BN_CTX_start(ctx);

@@ -358,26 +393,26 @@ int ossl_ecdsa_verify_sig(const unsigned

     m = BN_CTX_get(ctx);

     X = BN_CTX_get(ctx);

     if (X == NULL) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     order = EC_GROUP_get0_order(group);

     if (order == NULL) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_EC_LIB);

         goto err;

     }

     if (BN_is_zero(sig->r) || BN_is_negative(sig->r) ||

         BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) ||

         BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_BAD_SIGNATURE);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, EC_R_BAD_SIGNATURE);

         ret = 0;                /* signature is invalid */

         goto err;

     }

     /* calculate tmp1 = inv(S) mod order */

     if (!ec_group_do_inverse_ord(group, u2, sig->s, ctx)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     /* digest -> m */

@@ -388,41 +423,41 @@ int ossl_ecdsa_verify_sig(const unsigned

     if (8 * dgst_len > i)

         dgst_len = (i + 7) / 8;

     if (!BN_bin2bn(dgst, dgst_len, m)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     /* If still too long truncate remaining bits with a shift */

     if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     /* u1 = m * tmp mod order */

     if (!BN_mod_mul(u1, m, u2, order, ctx)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     /* u2 = r * w mod q */

     if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     if ((point = EC_POINT_new(group)) == NULL) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_MALLOC_FAILURE);

         goto err;

     }

     if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_EC_LIB);

         goto err;

     }

     if (!EC_POINT_get_affine_coordinates(group, point, X, NULL, ctx)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_EC_LIB);

         goto err;

     }

     if (!BN_nnmod(u1, X, order, ctx)) {

-        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);

+        ECerr(EC_F_ECDSA_SIMPLE_VERIFY_SIG, ERR_R_BN_LIB);

         goto err;

     }

     /*  if the signature is correct u1 is equal to sig->r */

diff -up openssl-1.1.1c/crypto/ec/ec_err.c.s390x-ecc openssl-1.1.1c/crypto/ec/ec_err.c

--- openssl-1.1.1c/crypto/ec/ec_err.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ec_err.c	2019-11-20 11:36:02.192860416 +0100

@@ -31,6 +31,11 @@ static const ERR_STRING_DATA EC_str_func

     {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_SIGN_SETUP, 0), "ECDSA_sign_setup"},

     {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_SIG_NEW, 0), "ECDSA_SIG_new"},

     {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_VERIFY, 0), "ECDSA_verify"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_SIMPLE_SIGN_SETUP, 0), "ecdsa_simple_sign_setup"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_SIMPLE_SIGN_SIG, 0), "ecdsa_simple_sign_sig"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_SIMPLE_VERIFY_SIG, 0), "ecdsa_simple_verify_sig"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_S390X_NISTP_SIGN_SIG, 0), "ecdsa_s390x_nistp_sign_sig"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, 0), "ecdsa_s390x_nistp_verify_sig"},

     {ERR_PACK(ERR_LIB_EC, EC_F_ECD_ITEM_VERIFY, 0), "ecd_item_verify"},

     {ERR_PACK(ERR_LIB_EC, EC_F_ECKEY_PARAM2TYPE, 0), "eckey_param2type"},

     {ERR_PACK(ERR_LIB_EC, EC_F_ECKEY_PARAM_DECODE, 0), "eckey_param_decode"},

@@ -266,6 +271,7 @@ static const ERR_STRING_DATA EC_str_func

     {ERR_PACK(ERR_LIB_EC, EC_F_OLD_EC_PRIV_DECODE, 0), "old_ec_priv_decode"},

     {ERR_PACK(ERR_LIB_EC, EC_F_OSSL_ECDH_COMPUTE_KEY, 0),

      "ossl_ecdh_compute_key"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_OSSL_ECDSA_SIGN_SETUP, 0), "ossl_ecdsa_sign_setup"},

     {ERR_PACK(ERR_LIB_EC, EC_F_OSSL_ECDSA_SIGN_SIG, 0), "ossl_ecdsa_sign_sig"},

     {ERR_PACK(ERR_LIB_EC, EC_F_OSSL_ECDSA_VERIFY_SIG, 0),

      "ossl_ecdsa_verify_sig"},

@@ -284,6 +290,12 @@ static const ERR_STRING_DATA EC_str_func

     {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_KEYGEN, 0), "pkey_ec_keygen"},

     {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_PARAMGEN, 0), "pkey_ec_paramgen"},

     {ERR_PACK(ERR_LIB_EC, EC_F_PKEY_EC_SIGN, 0), "pkey_ec_sign"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_S390X_PKEY_ECD_DIGESTSIGN25519, 0), "s390x_pkey_ecd_digestsign25519"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_S390X_PKEY_ECD_DIGESTSIGN448, 0), "s390x_pkey_ecd_digestsign448"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_S390X_PKEY_ECD_KEYGEN25519, 0), "s390x_pkey_ecd_keygen25519"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_S390X_PKEY_ECD_KEYGEN448, 0), "s390x_pkey_ecd_keygen448"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_S390X_PKEY_ECX_KEYGEN25519, 0), "s390x_pkey_ecx_keygen25519"},

+    {ERR_PACK(ERR_LIB_EC, EC_F_S390X_PKEY_ECX_KEYGEN448, 0), "s390x_pkey_ecx_keygen448"},

     {ERR_PACK(ERR_LIB_EC, EC_F_VALIDATE_ECX_DERIVE, 0), "validate_ecx_derive"},

     {0, NULL}

 };

@@ -298,6 +310,8 @@ static const ERR_STRING_DATA EC_str_reas

     "coordinates out of range"},

     {ERR_PACK(ERR_LIB_EC, 0, EC_R_CURVE_DOES_NOT_SUPPORT_ECDH),

     "curve does not support ecdh"},

+    {ERR_PACK(ERR_LIB_EC, 0, EC_R_CURVE_DOES_NOT_SUPPORT_ECDSA),

+    "curve does not support ecdsa"},

     {ERR_PACK(ERR_LIB_EC, 0, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING),

     "curve does not support signing"},

     {ERR_PACK(ERR_LIB_EC, 0, EC_R_D2I_ECPKPARAMETERS_FAILURE),

diff -up openssl-1.1.1c/crypto/ec/ec_lcl.h.s390x-ecc openssl-1.1.1c/crypto/ec/ec_lcl.h

--- openssl-1.1.1c/crypto/ec/ec_lcl.h.s390x-ecc	2019-11-20 11:36:01.676869466 +0100

+++ openssl-1.1.1c/crypto/ec/ec_lcl.h	2019-11-20 11:36:02.192860416 +0100

@@ -154,7 +154,7 @@ struct ec_method_st {

     int (*field_div) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a,

                       const BIGNUM *b, BN_CTX *);

     /*-

-     * 'field_inv' computes the multipicative inverse of a in the field,

+     * 'field_inv' computes the multiplicative inverse of a in the field,

      * storing the result in r.

      *

      * If 'a' is zero (or equivalent), you'll get an EC_R_CANNOT_INVERT error.

@@ -179,6 +179,14 @@ struct ec_method_st {

     /* custom ECDH operation */

     int (*ecdh_compute_key)(unsigned char **pout, size_t *poutlen,

                             const EC_POINT *pub_key, const EC_KEY *ecdh);

+    /* custom ECDSA */

+    int (*ecdsa_sign_setup)(EC_KEY *eckey, BN_CTX *ctx, BIGNUM **kinvp,

+                            BIGNUM **rp);

+    ECDSA_SIG *(*ecdsa_sign_sig)(const unsigned char *dgst, int dgstlen,

+                                 const BIGNUM *kinv, const BIGNUM *r,

+                                 EC_KEY *eckey);

+    int (*ecdsa_verify_sig)(const unsigned char *dgst, int dgstlen,

+                            const ECDSA_SIG *sig, EC_KEY *eckey);

     /* Inverse modulo order */

     int (*field_inverse_mod_ord)(const EC_GROUP *, BIGNUM *r,

                                  const BIGNUM *x, BN_CTX *);

@@ -587,6 +595,11 @@ int ec_group_simple_order_bits(const EC_

  */

 const EC_METHOD *EC_GFp_nistz256_method(void);

 #endif

+#ifdef S390X_EC_ASM

+const EC_METHOD *EC_GFp_s390x_nistp256_method(void);

+const EC_METHOD *EC_GFp_s390x_nistp384_method(void);

+const EC_METHOD *EC_GFp_s390x_nistp521_method(void);

+#endif

 size_t ec_key_simple_priv2oct(const EC_KEY *eckey,

                               unsigned char *buf, size_t len);

@@ -649,6 +662,13 @@ int ossl_ecdsa_verify(int type, const un

                       const unsigned char *sigbuf, int sig_len, EC_KEY *eckey);

 int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,

                           const ECDSA_SIG *sig, EC_KEY *eckey);

+int ecdsa_simple_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,

+                            BIGNUM **rp);

+ECDSA_SIG *ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len,

+                                 const BIGNUM *in_kinv, const BIGNUM *in_r,

+                                 EC_KEY *eckey);

+int ecdsa_simple_verify_sig(const unsigned char *dgst, int dgst_len,

+                            const ECDSA_SIG *sig, EC_KEY *eckey);

 int ED25519_sign(uint8_t *out_sig, const uint8_t *message, size_t message_len,

                  const uint8_t public_key[32], const uint8_t private_key[32]);

diff -up openssl-1.1.1c/crypto/ec/ec_pmeth.c.s390x-ecc openssl-1.1.1c/crypto/ec/ec_pmeth.c

--- openssl-1.1.1c/crypto/ec/ec_pmeth.c.s390x-ecc	2019-11-20 11:36:02.101862012 +0100

+++ openssl-1.1.1c/crypto/ec/ec_pmeth.c	2019-11-20 11:36:02.193860398 +0100

@@ -474,3 +474,8 @@ const EVP_PKEY_METHOD ec_pkey_meth = {

     pkey_ec_ctrl,

     pkey_ec_ctrl_str

 };

+

+const EVP_PKEY_METHOD *ec_pkey_method(void)

+{

+    return &ec_pkey_meth;

+}

diff -up openssl-1.1.1c/crypto/ec/ecp_mont.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_mont.c

--- openssl-1.1.1c/crypto/ec/ecp_mont.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ecp_mont.c	2019-11-20 11:36:02.193860398 +0100

@@ -63,6 +63,9 @@ const EC_METHOD *EC_GFp_mont_method(void

         0, /* keycopy */

         0, /* keyfinish */

         ecdh_simple_compute_key,

+        ecdsa_simple_sign_setup,

+        ecdsa_simple_sign_sig,

+        ecdsa_simple_verify_sig,

         0, /* field_inverse_mod_ord */

         ec_GFp_simple_blind_coordinates,

         ec_GFp_simple_ladder_pre,

diff -up openssl-1.1.1c/crypto/ec/ecp_nist.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_nist.c

--- openssl-1.1.1c/crypto/ec/ecp_nist.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ecp_nist.c	2019-11-20 11:36:02.193860398 +0100

@@ -65,6 +65,9 @@ const EC_METHOD *EC_GFp_nist_method(void

         0, /* keycopy */

         0, /* keyfinish */

         ecdh_simple_compute_key,

+        ecdsa_simple_sign_setup,

+        ecdsa_simple_sign_sig,

+        ecdsa_simple_verify_sig,

         0, /* field_inverse_mod_ord */

         ec_GFp_simple_blind_coordinates,

         ec_GFp_simple_ladder_pre,

diff -up openssl-1.1.1c/crypto/ec/ecp_nistp224.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_nistp224.c

--- openssl-1.1.1c/crypto/ec/ecp_nistp224.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ecp_nistp224.c	2019-11-20 11:36:02.193860398 +0100

@@ -292,6 +292,9 @@ const EC_METHOD *EC_GFp_nistp224_method(

         0, /* keycopy */

         0, /* keyfinish */

         ecdh_simple_compute_key,

+        ecdsa_simple_sign_setup,

+        ecdsa_simple_sign_sig,

+        ecdsa_simple_verify_sig,

         0, /* field_inverse_mod_ord */

         0, /* blind_coordinates */

         0, /* ladder_pre */

diff -up openssl-1.1.1c/crypto/ec/ecp_nistp256.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_nistp256.c

--- openssl-1.1.1c/crypto/ec/ecp_nistp256.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ecp_nistp256.c	2019-11-20 11:36:02.194860380 +0100

@@ -1823,6 +1823,9 @@ const EC_METHOD *EC_GFp_nistp256_method(

         0, /* keycopy */

         0, /* keyfinish */

         ecdh_simple_compute_key,

+        ecdsa_simple_sign_setup,

+        ecdsa_simple_sign_sig,

+        ecdsa_simple_verify_sig,

         0, /* field_inverse_mod_ord */

         0, /* blind_coordinates */

         0, /* ladder_pre */

diff -up openssl-1.1.1c/crypto/ec/ecp_nistp521.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_nistp521.c

--- openssl-1.1.1c/crypto/ec/ecp_nistp521.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ecp_nistp521.c	2019-11-20 11:36:02.194860380 +0100

@@ -1665,6 +1665,9 @@ const EC_METHOD *EC_GFp_nistp521_method(

         0, /* keycopy */

         0, /* keyfinish */

         ecdh_simple_compute_key,

+        ecdsa_simple_sign_setup,

+        ecdsa_simple_sign_sig,

+        ecdsa_simple_verify_sig,

         0, /* field_inverse_mod_ord */

         0, /* blind_coordinates */

         0, /* ladder_pre */

diff -up openssl-1.1.1c/crypto/ec/ecp_nistz256.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_nistz256.c

--- openssl-1.1.1c/crypto/ec/ecp_nistz256.c.s390x-ecc	2019-05-28 15:12:21.000000000 +0200

+++ openssl-1.1.1c/crypto/ec/ecp_nistz256.c	2019-11-20 11:36:02.195860363 +0100

@@ -1689,6 +1689,9 @@ const EC_METHOD *EC_GFp_nistz256_method(

         0, /* keycopy */

         0, /* keyfinish */

         ecdh_simple_compute_key,

+        ecdsa_simple_sign_setup,

+        ecdsa_simple_sign_sig,

+        ecdsa_simple_verify_sig,

         ecp_nistz256_inv_mod_ord,                   /* can be #define-d NULL */

         0,                                          /* blind_coordinates */

         0,                                          /* ladder_pre */

diff -up openssl-1.1.1c/crypto/ec/ecp_s390x_nistp.c.s390x-ecc openssl-1.1.1c/crypto/ec/ecp_s390x_nistp.c

--- openssl-1.1.1c/crypto/ec/ecp_s390x_nistp.c.s390x-ecc	2019-11-20 11:36:02.195860363 +0100

+++ openssl-1.1.1c/crypto/ec/ecp_s390x_nistp.c	2019-11-20 11:36:02.195860363 +0100

@@ -0,0 +1,394 @@

+/*

+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.

+ *

+ * Licensed under the Apache License 2.0 (the "License").  You may not use

+ * this file except in compliance with the License.  You can obtain a copy

+ * in the file LICENSE in the source distribution or at

+ * https://www.openssl.org/source/license.html

+ */

+

+#include <stdlib.h>

+#include <string.h>

+#include <openssl/err.h>

+#include <openssl/rand.h>

+#include "ec_lcl.h"

+#include "s390x_arch.h"

+

+/* Size of parameter blocks */

+#define S390X_SIZE_PARAM                4096

+

+/* Size of fields in parameter blocks */

+#define S390X_SIZE_P256                 32

+#define S390X_SIZE_P384                 48

+#define S390X_SIZE_P521                 80

+

+/* Offsets of fields in PCC parameter blocks */

+#define S390X_OFF_RES_X(n)              (0 * n)

+#define S390X_OFF_RES_Y(n)              (1 * n)

+#define S390X_OFF_SRC_X(n)              (2 * n)

+#define S390X_OFF_SRC_Y(n)              (3 * n)

+#define S390X_OFF_SCALAR(n)             (4 * n)

+

+/* Offsets of fields in KDSA parameter blocks */

+#define S390X_OFF_R(n)                  (0 * n)

+#define S390X_OFF_S(n)                  (1 * n)

+#define S390X_OFF_H(n)                  (2 * n)

+#define S390X_OFF_K(n)                  (3 * n)

+#define S390X_OFF_X(n)                  (3 * n)

+#define S390X_OFF_RN(n)                 (4 * n)

+#define S390X_OFF_Y(n)                  (4 * n)

+

+static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,

+                                  const BIGNUM *scalar,

+                                  size_t num, const EC_POINT *points[],

+                                  const BIGNUM *scalars[],

+                                  BN_CTX *ctx, unsigned int fc, int len)

+{

+    unsigned char param[S390X_SIZE_PARAM];

+    BIGNUM *x, *y;

+    const EC_POINT *point_ptr = NULL;

+    const BIGNUM *scalar_ptr = NULL;

+    BN_CTX *new_ctx = NULL;

+    int rc = -1;

+

+    if (ctx == NULL) {

+        ctx = new_ctx = BN_CTX_new();

+        if (ctx == NULL)

+            return 0;

+    }

+

+    BN_CTX_start(ctx);

+

+    x = BN_CTX_get(ctx);

+    y = BN_CTX_get(ctx);

+    if (x == NULL || y == NULL) {

+        rc = 0;

+        goto ret;

+    }

+

+    /*

+     * Use PCC for EC keygen and ECDH key derivation:

+     * scalar * generator and scalar * peer public key,

+     * scalar in [0,order).

+     */

+    if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)

+        || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {

+

+        if (num == 0) {

+            point_ptr = EC_GROUP_get0_generator(group);

+            scalar_ptr = scalar;

+        } else {

+            point_ptr = points[0];

+            scalar_ptr = scalars[0];

+        }

+

+        if (EC_POINT_is_at_infinity(group, point_ptr) == 1

+            || BN_is_zero(scalar_ptr)) {

+            rc = EC_POINT_set_to_infinity(group, r);

+            goto ret;

+        }

+

+        memset(&param, 0, sizeof(param));

+

+        if (group->meth->point_get_affine_coordinates(group, point_ptr,

+                                                      x, y, ctx) != 1

+            || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1

+            || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1

+            || BN_bn2binpad(scalar_ptr,

+                            param + S390X_OFF_SCALAR(len), len) == -1

+            || s390x_pcc(fc, param) != 0

+            || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL

+            || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL

+            || group->meth->point_set_affine_coordinates(group, r,

+                                                         x, y, ctx) != 1)

+            goto ret;

+

+        rc = 1;

+    }

+

+ret:

+    /* Otherwise use default. */

+    if (rc == -1)

+        rc = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);

+    OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len);

+    BN_CTX_end(ctx);

+    BN_CTX_free(new_ctx);

+    return rc;

+}

+

+static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,

+                                             int dgstlen,

+                                             const BIGNUM *kinv,

+                                             const BIGNUM *r,

+                                             EC_KEY *eckey,

+                                             unsigned int fc, int len)

+{

+    unsigned char param[S390X_SIZE_PARAM];

+    int ok = 0;

+    BIGNUM *k;

+    ECDSA_SIG *sig;

+    const EC_GROUP *group;

+    const BIGNUM *privkey;

+    int off;

+

+    group = EC_KEY_get0_group(eckey);

+    privkey = EC_KEY_get0_private_key(eckey);

+    if (group == NULL || privkey == NULL) {

+        ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, EC_R_MISSING_PARAMETERS);

+        return NULL;

+    }

+

+    if (!EC_KEY_can_sign(eckey)) {

+        ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG,

+              EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);

+        return NULL;

+    }

+

+    k = BN_secure_new();