package org.bouncycastle.crypto.generators;

import java.math.BigInteger;
import java.security.SecureRandom;

import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
import org.bouncycastle.crypto.AsymmetricCipherKeyPairGenerator;
import org.bouncycastle.crypto.KeyGenerationParameters;
import org.bouncycastle.crypto.params.ECDomainParameters;
import org.bouncycastle.crypto.params.ECKeyGenerationParameters;
import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
import org.bouncycastle.crypto.params.ECPublicKeyParameters;
import org.bouncycastle.math.ec.ECConstants;
import org.bouncycastle.math.ec.ECMultiplier;
import org.bouncycastle.math.ec.ECPoint;
import org.bouncycastle.math.ec.FixedPointCombMultiplier;

public class ECKeyPairGenerator
    implements AsymmetricCipherKeyPairGenerator, ECConstants
{
    ECDomainParameters  params;
    SecureRandom        random;

    public void init(
        KeyGenerationParameters param)
    {
        ECKeyGenerationParameters  ecP = (ECKeyGenerationParameters)param;

        this.random = ecP.getRandom();
        this.params = ecP.getDomainParameters();

        if (this.random == null)
        {
            this.random = new SecureRandom();
        }
    }

    /**
     * Given the domain parameters this routine generates an EC key
     * pair in accordance with X9.62 section 5.2.1 pages 26, 27.
     */
    public AsymmetricCipherKeyPair generateKeyPair()
    {
        BigInteger n = params.getN();
        int        nBitLength = n.bitLength();
        BigInteger d;

        do
        {
            d = new BigInteger(nBitLength, random);
        }
        while (d.equals(ZERO)  || (d.compareTo(n) >= 0));

        ECPoint Q = createBasePointMultiplier().multiply(params.getG(), d);

        return new AsymmetricCipherKeyPair(
            new ECPublicKeyParameters(Q, params),
            new ECPrivateKeyParameters(d, params));
    }

    protected ECMultiplier createBasePointMultiplier()
    {
        return new FixedPointCombMultiplier();
    }
}

@@ -715,16 +715,58 @@
 tiplier;
+%0Aimport org.bouncycastle.math.ec.WNafUtil;
 %0A%0Apublic
@@ -1515,23 +1515,16 @@
     int 
-       
 nBitLeng
@@ -1539,24 +1539,67 @@
 itLength();%0A
+        int minWeight = nBitLength %3E%3E%3E 2;%0A%0A
         BigI
@@ -1608,25 +1608,24 @@
 eger d;%0A
-%0A
         
 do%0A     
@@ -1616,18 +1616,24 @@
         
-do
+for (;;)
 %0A       
@@ -1691,47 +1691,45 @@
 m);%0A
-  
+%0A
       
-%7D%0A
       
-  while (d.equals(ZERO)
+if (d.compareTo(TWO) %3C 0
   %7C%7C
@@ -1751,17 +1751,546 @@
 ) %3E= 0))
-;
+%0A            %7B%0A                continue;%0A            %7D%0A%0A            /*%0A             * Require a minimum weight of the NAF representation, since low-weight primes may be%0A             * weak against a version of the number-field-sieve for the discrete-logarithm-problem.%0A             * %0A             * See %22The number field sieve for integers of low weight%22, Oliver Schirokauer.%0A             */%0A            if (WNafUtil.getNafWeight(d) %3C minWeight)%0A            %7B%0A                continue;%0A            %7D%0A%0A            break;%0A        %7D
 %0A%0A      

Add low-weight guard to ECKeyPairGenerator