Commit d172868e53 for openssl.org
commit d172868e5337563ecc0431e52ccb612951a6c576
Author: Viktor Dukhovni <viktor@openssl.org>
Date: Sun Apr 26 04:05:02 2026 +1000
EC: make the group the single source of the point conversion form
The point conversion form (compressed, uncompressed, or hybrid)
was kept both on the key and on the group, and the two could
disagree -- a key imported as compressed could re-encode as
uncompressed. The group is now the single source of truth:
encoding, parameter output, and the legacy lookup all read it from
the group, and decoding (PEM, DER, or raw parameters) records it
there, so the form round-trips faithfully.
Generated keys are always uncompressed; the point-format option at
key generation is now a documented no-op (it had had no effect for
several releases), and the unused form field on the keygen context
is dropped. Imported keys still keep their form, and the
deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still
work.
EVP_PKEY_fromdata() and openssl pkey -text now report the form a
loaded EC key actually has, and re-encoding via PEM or DER
preserves it.
Docs drop a stale note about a compile-time macro for compressed
points on binary curves, and the EC tests now exercise both the
affine and the compressed/hybrid binary formats unconditionally
(fixing a latent bug in the compressed/hybrid form tests that were
never exercised by CI).
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Jul 10 09:21:29 2026
(Merged from https://github.com/openssl/openssl/pull/30940)
diff --git a/apps/ec.c b/apps/ec.c
index 588b488ac1..8ed452a153 100644
--- a/apps/ec.c
+++ b/apps/ec.c
@@ -54,7 +54,7 @@ const OPTIONS ec_options[] = {
{ "check", OPT_CHECK, '-', "check key consistency" },
{ "", OPT_CIPHER, '-', "Any supported cipher" },
{ "param_enc", OPT_PARAM_ENC, 's',
- "Specifies the way the ec parameters are encoded" },
+ "Selects between named_curve and explicit EC parameter encoding" },
{ "conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form " },
OPT_SECTION("Output"),
diff --git a/apps/ecparam.c b/apps/ecparam.c
index cbb2ec8d50..aece2cb81d 100644
--- a/apps/ecparam.c
+++ b/apps/ecparam.c
@@ -57,7 +57,7 @@ const OPTIONS ecparam_options[] = {
{ "text", OPT_TEXT, '-', "Print the ec parameters in text form" },
{ "noout", OPT_NOOUT, '-', "Do not print the ec parameter" },
{ "param_enc", OPT_PARAM_ENC, 's',
- "Specifies the way the ec parameters are encoded" },
+ "Selects between named_curve and explicit EC parameter encoding" },
OPT_SECTION("Parameter"),
{ "check", OPT_CHECK, '-', "Validate the ec parameters" },
diff --git a/apps/pkey.c b/apps/pkey.c
index 48b091c86d..868e411820 100644
--- a/apps/pkey.c
+++ b/apps/pkey.c
@@ -72,7 +72,7 @@ const OPTIONS pkey_options[] = {
{ "ec_conv_form", OPT_EC_CONV_FORM, 's',
"Specifies the EC point conversion form in the encoding" },
{ "ec_param_enc", OPT_EC_PARAM_ENC, 's',
- "Specifies the way the EC parameters are encoded" },
+ "Selects between named_curve and explicit EC parameter encoding" },
{ NULL }
};
diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
index cdc1826631..fdc3ce94c7 100644
--- a/crypto/ec/ec_asn1.c
+++ b/crypto/ec/ec_asn1.c
@@ -1063,7 +1063,7 @@ int i2d_ECPrivateKey(const EC_KEY *a, unsigned char **out)
goto err;
}
- publen = EC_KEY_key2buf(a, a->conv_form, &pub, NULL);
+ publen = EC_KEY_key2buf(a, EC_KEY_get_conv_form(a), &pub, NULL);
if (publen == 0 || publen > INT_MAX) {
ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
@@ -1164,7 +1164,7 @@ int i2o_ECPublicKey(const EC_KEY *a, unsigned char **out)
}
buf_len = EC_POINT_point2oct(a->group, a->pub_key,
- a->conv_form, NULL, 0, NULL);
+ EC_KEY_get_conv_form(a), NULL, 0, NULL);
if (buf_len > INT_MAX) {
ERR_raise(ERR_LIB_EC, ERR_R_PASSED_INVALID_ARGUMENT);
@@ -1179,7 +1179,7 @@ int i2o_ECPublicKey(const EC_KEY *a, unsigned char **out)
return 0;
new_buffer = 1;
}
- if (!EC_POINT_point2oct(a->group, a->pub_key, a->conv_form,
+ if (!EC_POINT_point2oct(a->group, a->pub_key, EC_KEY_get_conv_form(a),
*out, buf_len, NULL)) {
ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
if (new_buffer) {
diff --git a/crypto/ec/ec_backend.c b/crypto/ec/ec_backend.c
index 0d1de52dbb..764ab7558b 100644
--- a/crypto/ec/ec_backend.c
+++ b/crypto/ec/ec_backend.c
@@ -655,7 +655,6 @@ EC_KEY *ossl_ec_key_dup(const EC_KEY *src, int selection)
/* copy the rest */
if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0) {
ret->enc_flag = src->enc_flag;
- ret->conv_form = src->conv_form;
}
ret->version = src->version;
diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 8deaa3b930..f5175653fa 100644
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -146,7 +146,6 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
/* copy the rest */
dest->enc_flag = src->enc_flag;
- dest->conv_form = src->conv_form;
dest->version = src->version;
dest->flags = src->flags;
#ifndef FIPS_MODULE
@@ -883,12 +882,13 @@ void EC_KEY_set_enc_flags(EC_KEY *key, unsigned int flags)
point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key)
{
- return key->conv_form;
+ return key->group != NULL
+ ? EC_GROUP_get_point_conversion_form(key->group)
+ : POINT_CONVERSION_UNCOMPRESSED;
}
void EC_KEY_set_conv_form(EC_KEY *key, point_conversion_form_t cform)
{
- key->conv_form = cform;
if (key->group != NULL)
EC_GROUP_set_point_conversion_form(key->group, cform);
}
@@ -959,8 +959,10 @@ int EC_KEY_oct2key(EC_KEY *key, const unsigned char *buf, size_t len,
* EC_POINT_oct2point() has already performed sanity checking of
* the buffer so we know it is valid.
*/
- if ((key->group->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0)
- key->conv_form = (point_conversion_form_t)(buf[0] & ~0x01);
+ if ((key->group->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
+ EC_GROUP_set_point_conversion_form(key->group,
+ (point_conversion_form_t)(buf[0] & ~0x01));
+ }
return 1;
}
diff --git a/crypto/ec/ec_kmeth.c b/crypto/ec/ec_kmeth.c
index b98bdd578e..b27a40519d 100644
--- a/crypto/ec/ec_kmeth.c
+++ b/crypto/ec/ec_kmeth.c
@@ -90,7 +90,6 @@ EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq)
ret->meth = EC_KEY_get_default_method();
ret->version = 1;
- ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
/* No ex_data inside the FIPS provider */
#ifndef FIPS_MODULE
diff --git a/crypto/ec/ec_local.h b/crypto/ec/ec_local.h
index 16adfbb92f..0be3c5529e 100644
--- a/crypto/ec/ec_local.h
+++ b/crypto/ec/ec_local.h
@@ -301,7 +301,6 @@ struct ec_key_st {
EC_POINT *pub_key;
BIGNUM *priv_key;
unsigned int enc_flag;
- point_conversion_form_t conv_form;
CRYPTO_REF_COUNT references;
int flags;
#ifndef FIPS_MODULE
diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
index fcf64ed004..2895db09a7 100644
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c
@@ -2405,13 +2405,10 @@ int EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY *pkey)
/* Might work through the legacy route */
const EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
- if (ec == NULL)
- return 0;
-
- return EC_KEY_get_conv_form(ec);
-#else
- return 0;
+ if (ec != NULL)
+ return EC_KEY_get_conv_form(ec);
#endif
+ return 0;
}
if (!EVP_PKEY_get_utf8_string_param(pkey,
diff --git a/doc/man1/openssl-ec.pod.in b/doc/man1/openssl-ec.pod.in
index a60b796c00..2fd397da00 100644
--- a/doc/man1/openssl-ec.pod.in
+++ b/doc/man1/openssl-ec.pod.in
@@ -122,9 +122,6 @@ This specifies how the points on the elliptic curve are converted
into octet strings. Possible values are: B<compressed>, B<uncompressed> (the
default value) and B<hybrid>. For more information regarding
the point conversion forms please read the X9.62 standard.
-B<Note> Due to patent issues the B<compressed> option is disabled
-by default for binary curves and can be enabled by defining
-the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
=item B<-param_enc> I<arg>
diff --git a/doc/man1/openssl-ecparam.pod.in b/doc/man1/openssl-ecparam.pod.in
index ca4e002762..d48f19d789 100644
--- a/doc/man1/openssl-ecparam.pod.in
+++ b/doc/man1/openssl-ecparam.pod.in
@@ -98,9 +98,6 @@ This specifies how the points on the elliptic curve are converted
into octet strings. Possible values are: B<compressed>, B<uncompressed> (the
default value) and B<hybrid>. For more information regarding
the point conversion forms please read the X9.62 standard.
-B<Note> Due to patent issues the B<compressed> option is disabled
-by default for binary curves and can be enabled by defining
-the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
=item B<-param_enc> I<arg>
diff --git a/doc/man1/openssl-pkey.pod.in b/doc/man1/openssl-pkey.pod.in
index 52cc5712b2..bb6fcde863 100644
--- a/doc/man1/openssl-pkey.pod.in
+++ b/doc/man1/openssl-pkey.pod.in
@@ -179,12 +179,9 @@ This cannot be combined with encoded output in DER format.
This option only applies to elliptic-curve based keys.
This specifies how the points on the elliptic curve are converted
-into octet strings. Possible values are: B<compressed> (the default
-value), B<uncompressed> and B<hybrid>. For more information regarding
+into octet strings. Possible values are: B<uncompressed> (the default
+value), B<compressed> and B<hybrid>. For more information regarding
the point conversion forms please read the X9.62 standard.
-B<Note> Due to patent issues the B<compressed> option is disabled
-by default for binary curves and can be enabled by defining
-the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
=item B<-ec_param_enc> I<arg>
diff --git a/doc/man7/EVP_PKEY-EC.pod b/doc/man7/EVP_PKEY-EC.pod
index 78ac13f332..714b5c3b60 100644
--- a/doc/man7/EVP_PKEY-EC.pod
+++ b/doc/man7/EVP_PKEY-EC.pod
@@ -94,6 +94,18 @@ Sets or gets the point_conversion_form for the I<key>. For a description of
point_conversion_forms please see L<EC_POINT_new(3)>. Valid values are
"uncompressed" or "compressed". The default value is "uncompressed".
+At key generation time the public point is emitted in uncompressed
+form. Any B<point-format> supplied via
+B<EVP_PKEY_CTX_set_params>(3) or B<-pkeyopt point-format:E<lt>formE<gt>>
+is validated -- an invalid value is rejected -- but is otherwise
+ignored on the generated key.
+
+On EC parameter generation the B<point-format> setting selects the
+encoding of the group's generator. On an existing key the setting
+is honoured normally, so imported keys retain their original form
+through B<EVP_PKEY_set_params>(3), B<EVP_PKEY_fromdata>(3),
+B<EVP_PKEY_todata>(3) and PEM/DER encoding and decoding.
+
=item "group-check" (B<OSSL_PKEY_PARAM_EC_GROUP_CHECK_TYPE>) <UTF8 string>
Sets or Gets the type of group check done when EVP_PKEY_param_check() is called.
diff --git a/providers/implementations/keymgmt/ec_kmgmt.c b/providers/implementations/keymgmt/ec_kmgmt.c
index 03c7ea3529..57ff812793 100644
--- a/providers/implementations/keymgmt/ec_kmgmt.c
+++ b/providers/implementations/keymgmt/ec_kmgmt.c
@@ -250,19 +250,10 @@ static ossl_inline int otherparams_to_params(const EC_KEY *ec, OSSL_PARAM_BLD *t
{
int ecdh_cofactor_mode = 0, group_check = 0;
const char *name = NULL;
- point_conversion_form_t format;
if (ec == NULL)
return 0;
- format = EC_KEY_get_conv_form(ec);
- name = ossl_ec_pt_format_id2name((int)format);
- if (name != NULL
- && !ossl_param_build_set_utf8_string(tmpl, params,
- OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
- name))
- return 0;
-
group_check = EC_KEY_get_flags(ec) & EC_FLAG_CHECK_NAMED_GROUP_MASK;
name = ossl_ec_check_group_type_id2name(group_check);
if (name != NULL
@@ -512,19 +503,21 @@ static int ec_export(void *keydata, int selection, OSSL_CALLBACK *param_cb,
&& (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0)
return 0;
- tmpl = OSSL_PARAM_BLD_new();
- if (tmpl == NULL)
+ if ((bnctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(ec))) == NULL)
return 0;
+ BN_CTX_start(bnctx);
- if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0) {
- bnctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(ec));
- if (bnctx == NULL) {
- ok = 0;
- goto end;
- }
- BN_CTX_start(bnctx);
- ok = ok && ossl_ec_group_todata(EC_KEY_get0_group(ec), tmpl, NULL, ossl_ec_key_get_libctx(ec), ossl_ec_key_get0_propq(ec), bnctx, &genbuf);
+ if ((tmpl = OSSL_PARAM_BLD_new()) == NULL) {
+ ok = 0;
+ goto end;
}
+ /*
+ * OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT is added based on the group's
+ * asn1_form by the call below.
+ */
+ ok = ossl_ec_group_todata(EC_KEY_get0_group(ec), tmpl, NULL,
+ ossl_ec_key_get_libctx(ec), ossl_ec_key_get0_propq(ec),
+ bnctx, &genbuf);
if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {
int include_private = selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY ? 1 : 0;
@@ -748,6 +741,10 @@ static int common_get_params(void *key, OSSL_PARAM params[], int sm2)
goto err;
}
+ /*
+ * OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT is added based on the group's
+ * asn1_form by ossl_ec_group_todata() below.
+ */
ret = ec_get_ecm_params(ecg, params)
&& ossl_ec_group_todata(ecg, NULL, params, libctx, propq, bnctx,
&genbuf)
@@ -1303,6 +1300,18 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
/* Whether you want it or not, you get a keypair, not just one half */
if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {
+ /*
+ * A generated key's public point has been serialised
+ * in uncompressed form for many releases, regardless
+ * of anything requested on the ctx or inherited from
+ * the template -- callers who consume the SPKI, EC
+ * PKCS#8 or other encodings rely on that. With group
+ * and key form now consolidated on a single field on
+ * the group, force it to uncompressed here rather
+ * than start emitting compressed public points where
+ * no caller was expecting them.
+ */
+ EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
#ifndef FIPS_MODULE
if (gctx->dhkem_ikm != NULL && gctx->dhkem_ikmlen != 0)
ret = ret && ossl_ec_generate_key_dhkem(ec, gctx->dhkem_ikm, gctx->dhkem_ikmlen);
@@ -1376,8 +1385,21 @@ static void *sm2_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
ret = ec_gen_assign_group(ec, gctx->gen_group);
/* Whether you want it or not, you get a keypair, not just one half */
- if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0)
+ if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {
+ /*
+ * A generated key's public point has been serialised
+ * in uncompressed form for many releases, regardless
+ * of anything requested on the ctx or inherited from
+ * the template -- callers who consume the SPKI, EC
+ * PKCS#8 or other encodings rely on that. With group
+ * and key form now consolidated on a single field on
+ * the group, force it to uncompressed here rather
+ * than start emitting compressed public points where
+ * no caller was expecting them.
+ */
+ EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
ret = ret && EC_KEY_generate_key(ec);
+ }
if (ret)
return ec;
diff --git a/test/ectest.c b/test/ectest.c
index 4665882e1c..36fcb50089 100644
--- a/test/ectest.c
+++ b/test/ectest.c
@@ -802,37 +802,22 @@ static int char2_curve_test(int n)
|| !TEST_true(BN_add(yplusone, y, BN_value_one())))
goto err;
-/* Change test based on whether binary point compression is enabled or not. */
-#ifdef OPENSSL_EC_BIN_PT_COMP
- /*
- * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
- * and therefore setting the coordinates should fail.
- */
- if (!TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone, ctx))
- || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x,
- test->y_bit,
- ctx))
- || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
- || !TEST_true(BN_hex2bn(&z, test->order))
- || !TEST_true(BN_hex2bn(&cof, test->cof))
- || !TEST_true(EC_GROUP_set_generator(group, P, z, cof))
- || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
- goto err;
- TEST_info("%s -- Generator", test->name);
- test_output_bignum("x", x);
- test_output_bignum("y", y);
- /* G_y value taken from the standard: */
- if (!TEST_true(BN_hex2bn(&z, test->y))
- || !TEST_BN_eq(y, z))
- goto err;
-#else
/*
* When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
* and therefore setting the coordinates should fail.
+ *
+ * Set the generator point P from its affine coordinates, and
+ * independently recover the same point Q from x and the y-bit via
+ * compressed coordinates. The two must agree, which exercises both
+ * the affine and compressed binary point formats in a single pass.
*/
if (!TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone, ctx))
|| !TEST_true(EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
|| !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
+ || !TEST_true(EC_POINT_set_compressed_coordinates(group, Q, x,
+ test->ybit, ctx))
+ || !TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)
+ || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx))
|| !TEST_true(BN_hex2bn(&z, test->order))
|| !TEST_true(BN_hex2bn(&cof, test->cof))
|| !TEST_true(EC_GROUP_set_generator(group, P, z, cof)))
@@ -840,7 +825,6 @@ static int char2_curve_test(int n)
TEST_info("%s -- Generator:", test->name);
test_output_bignum("x", x);
test_output_bignum("y", y);
-#endif
if (!TEST_int_eq(EC_GROUP_get_degree(group), test->degree)
|| !TEST_int_eq(EC_GROUP_security_bits(group), test->security)
@@ -971,26 +955,19 @@ static int char2_field_tests(void)
|| !TEST_ptr(cof = BN_new())
|| !TEST_ptr(yplusone = BN_new())
|| !TEST_true(BN_hex2bn(&x, "6"))
-/* Change test based on whether binary point compression is enabled or not. */
-#ifdef OPENSSL_EC_BIN_PT_COMP
- || !TEST_true(EC_POINT_set_compressed_coordinates(group, Q, x, 1, ctx))
-#else
|| !TEST_true(BN_hex2bn(&y, "8"))
- || !TEST_true(EC_POINT_set_affine_coordinates(group, Q, x, y, ctx))
-#endif
- )
+ || !TEST_true(EC_POINT_set_affine_coordinates(group, Q, x, y, ctx)))
goto err;
if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
-/* Change test based on whether binary point compression is enabled or not. */
-#ifdef OPENSSL_EC_BIN_PT_COMP
- if (!TEST_true(EC_POINT_get_affine_coordinates(group, Q, x, y, ctx)))
- goto err;
-#endif
TEST_info("Point is not on curve");
test_output_bignum("x", x);
test_output_bignum("y", y);
goto err;
}
+ /* The same point recovered from compressed coordinates must agree. */
+ if (!TEST_true(EC_POINT_set_compressed_coordinates(group, R, x, 1, ctx))
+ || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx)))
+ goto err;
TEST_note("A cyclic subgroup:");
k = 100;
@@ -1018,8 +995,6 @@ static int char2_field_tests(void)
|| !TEST_true(EC_POINT_is_at_infinity(group, P)))
goto err;
-/* Change test based on whether binary point compression is enabled or not. */
-#ifdef OPENSSL_EC_BIN_PT_COMP
len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED,
buf, sizeof(buf), ctx);
if (!TEST_size_t_ne(len, 0)
@@ -1028,7 +1003,6 @@ static int char2_field_tests(void)
goto err;
test_output_memory("Generator as octet string, compressed form:",
buf, len);
-#endif
len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
buf, sizeof(buf), ctx);
@@ -1039,8 +1013,6 @@ static int char2_field_tests(void)
test_output_memory("Generator as octet string, uncompressed form:",
buf, len);
-/* Change test based on whether binary point compression is enabled or not. */
-#ifdef OPENSSL_EC_BIN_PT_COMP
len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof(buf),
ctx);
if (!TEST_size_t_ne(len, 0)
@@ -1049,7 +1021,6 @@ static int char2_field_tests(void)
goto err;
test_output_memory("Generator as octet string, hybrid form:",
buf, len);
-#endif
if (!TEST_true(EC_POINT_invert(group, P, ctx))
|| !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx)))