/src/openssl/crypto/bn/bn_mont.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | /* |
11 | | * Details about Montgomery multiplication algorithms can be found at |
12 | | * http://security.ece.orst.edu/publications.html, e.g. |
13 | | * http://security.ece.orst.edu/koc/papers/j37acmon.pdf and |
14 | | * sections 3.8 and 4.2 in http://security.ece.orst.edu/koc/papers/r01rsasw.pdf |
15 | | */ |
16 | | |
17 | | #include "internal/cryptlib.h" |
18 | | #include "bn_local.h" |
19 | | |
20 | | #define MONT_WORD /* use the faster word-based algorithm */ |
21 | | |
22 | | #ifdef MONT_WORD |
23 | | static int bn_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont); |
24 | | #endif |
25 | | |
26 | | int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, |
27 | | BN_MONT_CTX *mont, BN_CTX *ctx) |
28 | 2.34M | { |
29 | 2.34M | int ret = bn_mul_mont_fixed_top(r, a, b, mont, ctx); |
30 | | |
31 | 2.34M | bn_correct_top(r); |
32 | 2.34M | bn_check_top(r); |
33 | | |
34 | 2.34M | return ret; |
35 | 2.34M | } |
36 | | |
37 | | int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, |
38 | | BN_MONT_CTX *mont, BN_CTX *ctx) |
39 | 68.6M | { |
40 | 68.6M | BIGNUM *tmp; |
41 | 68.6M | int ret = 0; |
42 | 68.6M | int num = mont->N.top; |
43 | | |
44 | 68.6M | #if defined(OPENSSL_BN_ASM_MONT) && defined(MONT_WORD) |
45 | 68.6M | if (num > 1 && num <= BN_SOFT_LIMIT && a->top == num && b->top == num) { |
46 | 67.1M | if (bn_wexpand(r, num) == NULL) |
47 | 0 | return 0; |
48 | 67.1M | if (bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num)) { |
49 | 67.1M | r->neg = a->neg ^ b->neg; |
50 | 67.1M | r->top = num; |
51 | 67.1M | r->flags |= BN_FLG_FIXED_TOP; |
52 | 67.1M | return 1; |
53 | 67.1M | } |
54 | 67.1M | } |
55 | 1.49M | #endif |
56 | | |
57 | 1.49M | if ((a->top + b->top) > 2 * num) |
58 | 0 | return 0; |
59 | | |
60 | 1.49M | BN_CTX_start(ctx); |
61 | 1.49M | tmp = BN_CTX_get(ctx); |
62 | 1.49M | if (tmp == NULL) |
63 | 0 | goto err; |
64 | | |
65 | 1.49M | bn_check_top(tmp); |
66 | 1.49M | if (a == b) { |
67 | 1.12M | if (!bn_sqr_fixed_top(tmp, a, ctx)) |
68 | 0 | goto err; |
69 | 1.12M | } else { |
70 | 366k | if (!bn_mul_fixed_top(tmp, a, b, ctx)) |
71 | 0 | goto err; |
72 | 366k | } |
73 | | /* reduce from aRR to aR */ |
74 | 1.49M | #ifdef MONT_WORD |
75 | 1.49M | if (!bn_from_montgomery_word(r, tmp, mont)) |
76 | 0 | goto err; |
77 | | #else |
78 | | if (!BN_from_montgomery(r, tmp, mont, ctx)) |
79 | | goto err; |
80 | | #endif |
81 | 1.49M | ret = 1; |
82 | 1.49M | err: |
83 | 1.49M | BN_CTX_end(ctx); |
84 | 1.49M | return ret; |
85 | 1.49M | } |
86 | | |
87 | | #ifdef MONT_WORD |
88 | | static int bn_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont) |
89 | 1.55M | { |
90 | 1.55M | BIGNUM *n; |
91 | 1.55M | BN_ULONG *ap, *np, *rp, n0, v, carry; |
92 | 1.55M | int nl, max, i; |
93 | 1.55M | unsigned int rtop; |
94 | | |
95 | 1.55M | n = &(mont->N); |
96 | 1.55M | nl = n->top; |
97 | 1.55M | if (nl == 0) { |
98 | 0 | ret->top = 0; |
99 | 0 | return 1; |
100 | 0 | } |
101 | | |
102 | 1.55M | max = (2 * nl); /* carry is stored separately */ |
103 | 1.55M | if (bn_wexpand(r, max) == NULL) |
104 | 0 | return 0; |
105 | | |
106 | 1.55M | r->neg ^= n->neg; |
107 | 1.55M | np = n->d; |
108 | 1.55M | rp = r->d; |
109 | | |
110 | | /* clear the top words of T */ |
111 | 21.2M | for (rtop = r->top, i = 0; i < max; i++) { |
112 | 19.7M | v = (BN_ULONG)0 - ((i - rtop) >> (8 * sizeof(rtop) - 1)); |
113 | 19.7M | rp[i] &= v; |
114 | 19.7M | } |
115 | | |
116 | 1.55M | r->top = max; |
117 | 1.55M | r->flags |= BN_FLG_FIXED_TOP; |
118 | 1.55M | n0 = mont->n0[0]; |
119 | | |
120 | | /* |
121 | | * Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On |
122 | | * input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r| |
123 | | * includes |carry| which is stored separately. |
124 | | */ |
125 | 11.4M | for (carry = 0, i = 0; i < nl; i++, rp++) { |
126 | 9.85M | v = bn_mul_add_words(rp, np, nl, (rp[0] * n0) & BN_MASK2); |
127 | 9.85M | v = (v + carry + rp[nl]) & BN_MASK2; |
128 | 9.85M | carry |= (v != rp[nl]); |
129 | 9.85M | carry &= (v <= rp[nl]); |
130 | 9.85M | rp[nl] = v; |
131 | 9.85M | } |
132 | | |
133 | 1.55M | if (bn_wexpand(ret, nl) == NULL) |
134 | 0 | return 0; |
135 | 1.55M | ret->top = nl; |
136 | 1.55M | ret->flags |= BN_FLG_FIXED_TOP; |
137 | 1.55M | ret->neg = r->neg; |
138 | | |
139 | 1.55M | rp = ret->d; |
140 | | |
141 | | /* |
142 | | * Shift |nl| words to divide by R. We have |ap| < 2 * |n|. Note that |ap| |
143 | | * includes |carry| which is stored separately. |
144 | | */ |
145 | 1.55M | ap = &(r->d[nl]); |
146 | | |
147 | 1.55M | carry -= bn_sub_words(rp, ap, np, nl); |
148 | | /* |
149 | | * |carry| is -1 if |ap| - |np| underflowed or zero if it did not. Note |
150 | | * |carry| cannot be 1. That would imply the subtraction did not fit in |
151 | | * |nl| words, and we know at most one subtraction is needed. |
152 | | */ |
153 | 11.4M | for (i = 0; i < nl; i++) { |
154 | 9.85M | rp[i] = (carry & ap[i]) | (~carry & rp[i]); |
155 | 9.85M | ap[i] = 0; |
156 | 9.85M | } |
157 | | |
158 | 1.55M | return 1; |
159 | 1.55M | } |
160 | | #endif /* MONT_WORD */ |
161 | | |
162 | | int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont, |
163 | | BN_CTX *ctx) |
164 | 61.1k | { |
165 | 61.1k | int retn; |
166 | | |
167 | 61.1k | retn = bn_from_mont_fixed_top(ret, a, mont, ctx); |
168 | 61.1k | bn_correct_top(ret); |
169 | 61.1k | bn_check_top(ret); |
170 | | |
171 | 61.1k | return retn; |
172 | 61.1k | } |
173 | | |
174 | | int bn_from_mont_fixed_top(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont, |
175 | | BN_CTX *ctx) |
176 | 61.1k | { |
177 | 61.1k | int retn = 0; |
178 | 61.1k | #ifdef MONT_WORD |
179 | 61.1k | BIGNUM *t; |
180 | | |
181 | 61.1k | BN_CTX_start(ctx); |
182 | 61.1k | if ((t = BN_CTX_get(ctx)) && BN_copy(t, a)) { |
183 | 61.1k | retn = bn_from_montgomery_word(ret, t, mont); |
184 | 61.1k | } |
185 | 61.1k | BN_CTX_end(ctx); |
186 | | #else /* !MONT_WORD */ |
187 | | BIGNUM *t1, *t2; |
188 | | |
189 | | BN_CTX_start(ctx); |
190 | | t1 = BN_CTX_get(ctx); |
191 | | t2 = BN_CTX_get(ctx); |
192 | | if (t2 == NULL) |
193 | | goto err; |
194 | | |
195 | | if (!BN_copy(t1, a)) |
196 | | goto err; |
197 | | BN_mask_bits(t1, mont->ri); |
198 | | |
199 | | if (!BN_mul(t2, t1, &mont->Ni, ctx)) |
200 | | goto err; |
201 | | BN_mask_bits(t2, mont->ri); |
202 | | |
203 | | if (!BN_mul(t1, t2, &mont->N, ctx)) |
204 | | goto err; |
205 | | if (!BN_add(t2, a, t1)) |
206 | | goto err; |
207 | | if (!BN_rshift(ret, t2, mont->ri)) |
208 | | goto err; |
209 | | |
210 | | if (BN_ucmp(ret, &(mont->N)) >= 0) { |
211 | | if (!BN_usub(ret, ret, &(mont->N))) |
212 | | goto err; |
213 | | } |
214 | | retn = 1; |
215 | | bn_check_top(ret); |
216 | | err: |
217 | | BN_CTX_end(ctx); |
218 | | #endif /* MONT_WORD */ |
219 | 61.1k | return retn; |
220 | 61.1k | } |
221 | | |
222 | | int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont, |
223 | | BN_CTX *ctx) |
224 | 108k | { |
225 | 108k | return bn_mul_mont_fixed_top(r, a, &(mont->RR), mont, ctx); |
226 | 108k | } |
227 | | |
228 | | BN_MONT_CTX *BN_MONT_CTX_new(void) |
229 | 15.9k | { |
230 | 15.9k | BN_MONT_CTX *ret; |
231 | | |
232 | 15.9k | if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) |
233 | 0 | return NULL; |
234 | | |
235 | 15.9k | BN_MONT_CTX_init(ret); |
236 | 15.9k | ret->flags = BN_FLG_MALLOCED; |
237 | 15.9k | return ret; |
238 | 15.9k | } |
239 | | |
240 | | void BN_MONT_CTX_init(BN_MONT_CTX *ctx) |
241 | 10.6k | { |
242 | 10.6k | ctx->ri = 0; |
243 | 10.6k | bn_init(&ctx->RR); |
244 | 10.6k | bn_init(&ctx->N); |
245 | 10.6k | bn_init(&ctx->Ni); |
246 | 10.6k | ctx->n0[0] = ctx->n0[1] = 0; |
247 | 10.6k | ctx->flags = 0; |
248 | 10.6k | } |
249 | | |
250 | | void BN_MONT_CTX_free(BN_MONT_CTX *mont) |
251 | 11.6k | { |
252 | 11.6k | if (mont == NULL) |
253 | 1.01k | return; |
254 | 10.6k | BN_clear_free(&mont->RR); |
255 | 10.6k | BN_clear_free(&mont->N); |
256 | 10.6k | BN_clear_free(&mont->Ni); |
257 | 10.6k | if (mont->flags & BN_FLG_MALLOCED) |
258 | 10.6k | OPENSSL_free(mont); |
259 | 10.6k | } |
260 | | |
261 | | int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) |
262 | 10.6k | { |
263 | 10.6k | int i, ret = 0; |
264 | 10.6k | BIGNUM *Ri, *R; |
265 | | |
266 | 10.6k | if (BN_is_zero(mod)) |
267 | 57 | return 0; |
268 | | |
269 | 10.5k | BN_CTX_start(ctx); |
270 | 10.5k | if ((Ri = BN_CTX_get(ctx)) == NULL) |
271 | 0 | goto err; |
272 | 10.5k | R = &(mont->RR); /* grab RR as a temp */ |
273 | 10.5k | if (!BN_copy(&(mont->N), mod)) |
274 | 0 | goto err; /* Set N */ |
275 | 10.5k | if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0) |
276 | 835 | BN_set_flags(&(mont->N), BN_FLG_CONSTTIME); |
277 | 10.5k | mont->N.neg = 0; |
278 | | |
279 | 10.5k | #ifdef MONT_WORD |
280 | 10.5k | { |
281 | 10.5k | BIGNUM tmod; |
282 | 10.5k | BN_ULONG buf[2]; |
283 | | |
284 | 10.5k | bn_init(&tmod); |
285 | 10.5k | tmod.d = buf; |
286 | 10.5k | tmod.dmax = 2; |
287 | 10.5k | tmod.neg = 0; |
288 | | |
289 | 10.5k | if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0) |
290 | 835 | BN_set_flags(&tmod, BN_FLG_CONSTTIME); |
291 | | |
292 | 10.5k | mont->ri = (BN_num_bits(mod) + (BN_BITS2 - 1)) / BN_BITS2 * BN_BITS2; |
293 | | |
294 | | # if defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32) |
295 | | /* |
296 | | * Only certain BN_BITS2<=32 platforms actually make use of n0[1], |
297 | | * and we could use the #else case (with a shorter R value) for the |
298 | | * others. However, currently only the assembler files do know which |
299 | | * is which. |
300 | | */ |
301 | | |
302 | | BN_zero(R); |
303 | | if (!(BN_set_bit(R, 2 * BN_BITS2))) |
304 | | goto err; |
305 | | |
306 | | tmod.top = 0; |
307 | | if ((buf[0] = mod->d[0])) |
308 | | tmod.top = 1; |
309 | | if ((buf[1] = mod->top > 1 ? mod->d[1] : 0)) |
310 | | tmod.top = 2; |
311 | | |
312 | | if (BN_is_one(&tmod)) |
313 | | BN_zero(Ri); |
314 | | else if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL) |
315 | | goto err; |
316 | | if (!BN_lshift(Ri, Ri, 2 * BN_BITS2)) |
317 | | goto err; /* R*Ri */ |
318 | | if (!BN_is_zero(Ri)) { |
319 | | if (!BN_sub_word(Ri, 1)) |
320 | | goto err; |
321 | | } else { /* if N mod word size == 1 */ |
322 | | |
323 | | if (bn_expand(Ri, (int)sizeof(BN_ULONG) * 2) == NULL) |
324 | | goto err; |
325 | | /* Ri-- (mod double word size) */ |
326 | | Ri->neg = 0; |
327 | | Ri->d[0] = BN_MASK2; |
328 | | Ri->d[1] = BN_MASK2; |
329 | | Ri->top = 2; |
330 | | } |
331 | | if (!BN_div(Ri, NULL, Ri, &tmod, ctx)) |
332 | | goto err; |
333 | | /* |
334 | | * Ni = (R*Ri-1)/N, keep only couple of least significant words: |
335 | | */ |
336 | | mont->n0[0] = (Ri->top > 0) ? Ri->d[0] : 0; |
337 | | mont->n0[1] = (Ri->top > 1) ? Ri->d[1] : 0; |
338 | | # else |
339 | 10.5k | BN_zero(R); |
340 | 10.5k | if (!(BN_set_bit(R, BN_BITS2))) |
341 | 0 | goto err; /* R */ |
342 | | |
343 | 10.5k | buf[0] = mod->d[0]; /* tmod = N mod word size */ |
344 | 10.5k | buf[1] = 0; |
345 | 10.5k | tmod.top = buf[0] != 0 ? 1 : 0; |
346 | | /* Ri = R^-1 mod N */ |
347 | 10.5k | if (BN_is_one(&tmod)) |
348 | 283 | BN_zero(Ri); |
349 | 10.2k | else if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL) |
350 | 2.18k | goto err; |
351 | 8.37k | if (!BN_lshift(Ri, Ri, BN_BITS2)) |
352 | 0 | goto err; /* R*Ri */ |
353 | 8.37k | if (!BN_is_zero(Ri)) { |
354 | 8.08k | if (!BN_sub_word(Ri, 1)) |
355 | 0 | goto err; |
356 | 8.08k | } else { /* if N mod word size == 1 */ |
357 | | |
358 | 283 | if (!BN_set_word(Ri, BN_MASK2)) |
359 | 0 | goto err; /* Ri-- (mod word size) */ |
360 | 283 | } |
361 | 8.37k | if (!BN_div(Ri, NULL, Ri, &tmod, ctx)) |
362 | 0 | goto err; |
363 | | /* |
364 | | * Ni = (R*Ri-1)/N, keep only least significant word: |
365 | | */ |
366 | 8.37k | mont->n0[0] = (Ri->top > 0) ? Ri->d[0] : 0; |
367 | 8.37k | mont->n0[1] = 0; |
368 | 8.37k | # endif |
369 | 8.37k | } |
370 | | #else /* !MONT_WORD */ |
371 | | { /* bignum version */ |
372 | | mont->ri = BN_num_bits(&mont->N); |
373 | | BN_zero(R); |
374 | | if (!BN_set_bit(R, mont->ri)) |
375 | | goto err; /* R = 2^ri */ |
376 | | /* Ri = R^-1 mod N */ |
377 | | if ((BN_mod_inverse(Ri, R, &mont->N, ctx)) == NULL) |
378 | | goto err; |
379 | | if (!BN_lshift(Ri, Ri, mont->ri)) |
380 | | goto err; /* R*Ri */ |
381 | | if (!BN_sub_word(Ri, 1)) |
382 | | goto err; |
383 | | /* |
384 | | * Ni = (R*Ri-1) / N |
385 | | */ |
386 | | if (!BN_div(&(mont->Ni), NULL, Ri, &mont->N, ctx)) |
387 | | goto err; |
388 | | } |
389 | | #endif |
390 | | |
391 | | /* setup RR for conversions */ |
392 | 8.37k | BN_zero(&(mont->RR)); |
393 | 8.37k | if (!BN_set_bit(&(mont->RR), mont->ri * 2)) |
394 | 0 | goto err; |
395 | 8.37k | if (!BN_mod(&(mont->RR), &(mont->RR), &(mont->N), ctx)) |
396 | 0 | goto err; |
397 | | |
398 | 9.40k | for (i = mont->RR.top, ret = mont->N.top; i < ret; i++) |
399 | 1.02k | mont->RR.d[i] = 0; |
400 | 8.37k | mont->RR.top = ret; |
401 | 8.37k | mont->RR.flags |= BN_FLG_FIXED_TOP; |
402 | | |
403 | 8.37k | ret = 1; |
404 | 10.5k | err: |
405 | 10.5k | BN_CTX_end(ctx); |
406 | 10.5k | return ret; |
407 | 8.37k | } |
408 | | |
409 | | BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from) |
410 | 0 | { |
411 | 0 | if (to == from) |
412 | 0 | return to; |
413 | | |
414 | 0 | if (!BN_copy(&(to->RR), &(from->RR))) |
415 | 0 | return NULL; |
416 | 0 | if (!BN_copy(&(to->N), &(from->N))) |
417 | 0 | return NULL; |
418 | 0 | if (!BN_copy(&(to->Ni), &(from->Ni))) |
419 | 0 | return NULL; |
420 | 0 | to->ri = from->ri; |
421 | 0 | to->n0[0] = from->n0[0]; |
422 | 0 | to->n0[1] = from->n0[1]; |
423 | 0 | return to; |
424 | 0 | } |
425 | | |
426 | | BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_RWLOCK *lock, |
427 | | const BIGNUM *mod, BN_CTX *ctx) |
428 | 161 | { |
429 | 161 | BN_MONT_CTX *ret; |
430 | | |
431 | 161 | if (!CRYPTO_THREAD_read_lock(lock)) |
432 | 0 | return NULL; |
433 | 161 | ret = *pmont; |
434 | 161 | CRYPTO_THREAD_unlock(lock); |
435 | 161 | if (ret) |
436 | 0 | return ret; |
437 | | |
438 | | /* |
439 | | * We don't want to serialize globally while doing our lazy-init math in |
440 | | * BN_MONT_CTX_set. That punishes threads that are doing independent |
441 | | * things. Instead, punish the case where more than one thread tries to |
442 | | * lazy-init the same 'pmont', by having each do the lazy-init math work |
443 | | * independently and only use the one from the thread that wins the race |
444 | | * (the losers throw away the work they've done). |
445 | | */ |
446 | 161 | ret = BN_MONT_CTX_new(); |
447 | 161 | if (ret == NULL) |
448 | 0 | return NULL; |
449 | 161 | if (!BN_MONT_CTX_set(ret, mod, ctx)) { |
450 | 88 | BN_MONT_CTX_free(ret); |
451 | 88 | return NULL; |
452 | 88 | } |
453 | | |
454 | | /* The locked compare-and-set, after the local work is done. */ |
455 | 73 | if (!CRYPTO_THREAD_write_lock(lock)) { |
456 | 0 | BN_MONT_CTX_free(ret); |
457 | 0 | return NULL; |
458 | 0 | } |
459 | | |
460 | 73 | if (*pmont) { |
461 | 0 | BN_MONT_CTX_free(ret); |
462 | 0 | ret = *pmont; |
463 | 0 | } else |
464 | 73 | *pmont = ret; |
465 | 73 | CRYPTO_THREAD_unlock(lock); |
466 | 73 | return ret; |
467 | 73 | } |
468 | | |
469 | | int ossl_bn_mont_ctx_set(BN_MONT_CTX *ctx, const BIGNUM *modulus, int ri, const unsigned char *rr, |
470 | | size_t rrlen, uint32_t nlo, uint32_t nhi) |
471 | 0 | { |
472 | 0 | if (BN_copy(&ctx->N, modulus) == NULL) |
473 | 0 | return 0; |
474 | 0 | if (BN_bin2bn(rr, rrlen, &ctx->RR) == NULL) |
475 | 0 | return 0; |
476 | 0 | ctx->ri = ri; |
477 | | #if (BN_BITS2 <= 32) && defined(OPENSSL_BN_ASM_MONT) |
478 | | ctx->n0[0] = nlo; |
479 | | ctx->n0[1] = nhi; |
480 | | #elif BN_BITS2 <= 32 |
481 | | ctx->n0[0] = nlo; |
482 | | ctx->n0[1] = 0; |
483 | | #else |
484 | 0 | ctx->n0[0] = ((BN_ULONG)nhi << 32)| nlo; |
485 | 0 | ctx->n0[1] = 0; |
486 | 0 | #endif |
487 | |
|
488 | 0 | return 1; |
489 | 0 | } |
490 | | |
491 | | int ossl_bn_mont_ctx_eq(const BN_MONT_CTX *m1, const BN_MONT_CTX *m2) |
492 | 0 | { |
493 | 0 | if (m1->ri != m2->ri) |
494 | 0 | return 0; |
495 | 0 | if (BN_cmp(&m1->RR, &m2->RR) != 0) |
496 | 0 | return 0; |
497 | 0 | if (m1->flags != m2->flags) |
498 | 0 | return 0; |
499 | 0 | #ifdef MONT_WORD |
500 | 0 | if (m1->n0[0] != m2->n0[0]) |
501 | 0 | return 0; |
502 | 0 | if (m1->n0[1] != m2->n0[1]) |
503 | 0 | return 0; |
504 | | #else |
505 | | if (BN_cmp(&m1->Ni, &m2->Ni) != 0) |
506 | | return 0; |
507 | | #endif |
508 | 0 | return 1; |
509 | 0 | } |