/src/openssl/crypto/bn/bn_gcd.c

Source (jump to first uncovered line)
/* crypto/bn/bn_gcd.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 *
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 *
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */
/* ====================================================================
 * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include "cryptlib.h"
#include "bn_lcl.h"

static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);

int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
{
    BIGNUM *a, *b, *t;
    int ret = 0;

    bn_check_top(in_a);
    bn_check_top(in_b);

    BN_CTX_start(ctx);
    a = BN_CTX_get(ctx);
    b = BN_CTX_get(ctx);
    if (a == NULL || b == NULL)
        goto err;

    if (BN_copy(a, in_a) == NULL)
        goto err;
    if (BN_copy(b, in_b) == NULL)
        goto err;
    a->neg = 0;
    b->neg = 0;

    if (BN_cmp(a, b) < 0) {
        t = a;
        a = b;
        b = t;
    }
    t = euclid(a, b);
    if (t == NULL)
        goto err;

    if (BN_copy(r, t) == NULL)
        goto err;
    ret = 1;
 err:
    BN_CTX_end(ctx);
    bn_check_top(r);
    return (ret);
}

static BIGNUM *euclid(BIGNUM *a, BIGNUM *b)
{
    BIGNUM *t;
    int shifts = 0;

    bn_check_top(a);
    bn_check_top(b);

    /* 0 <= b <= a */
    while (!BN_is_zero(b)) {
        /* 0 < b <= a */

        if (BN_is_odd(a)) {
            if (BN_is_odd(b)) {
                if (!BN_sub(a, a, b))
                    goto err;
                if (!BN_rshift1(a, a))
                    goto err;
                if (BN_cmp(a, b) < 0) {
                    t = a;
                    a = b;
                    b = t;
                }
            } else {            /* a odd - b even */

                if (!BN_rshift1(b, b))
                    goto err;
                if (BN_cmp(a, b) < 0) {
                    t = a;
                    a = b;
                    b = t;
                }
            }
        } else {                /* a is even */

            if (BN_is_odd(b)) {
                if (!BN_rshift1(a, a))
                    goto err;
                if (BN_cmp(a, b) < 0) {
                    t = a;
                    a = b;
                    b = t;
                }
            } else {            /* a even - b even */

                if (!BN_rshift1(a, a))
                    goto err;
                if (!BN_rshift1(b, b))
                    goto err;
                shifts++;
            }
        }
        /* 0 <= b <= a */
    }

    if (shifts) {
        if (!BN_lshift(a, a, shifts))
            goto err;
    }
    bn_check_top(a);
    return (a);
 err:
    return (NULL);
}

/* solves ax == 1 (mod n) */
static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
                                        const BIGNUM *a, const BIGNUM *n,
                                        BN_CTX *ctx);

BIGNUM *BN_mod_inverse(BIGNUM *in,
                       const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
{
    BIGNUM *A, *B, *X, *Y, *M, *D, *T, *R = NULL;
    BIGNUM *ret = NULL;
    int sign;

    if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
        || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
        return BN_mod_inverse_no_branch(in, a, n, ctx);
    }

    bn_check_top(a);
    bn_check_top(n);

    BN_CTX_start(ctx);
    A = BN_CTX_get(ctx);
    B = BN_CTX_get(ctx);
    X = BN_CTX_get(ctx);
    D = BN_CTX_get(ctx);
    M = BN_CTX_get(ctx);
    Y = BN_CTX_get(ctx);
    T = BN_CTX_get(ctx);
    if (T == NULL)
        goto err;

    if (in == NULL)
        R = BN_new();
    else
        R = in;
    if (R == NULL)
        goto err;

    BN_one(X);
    BN_zero(Y);
    if (BN_copy(B, a) == NULL)
        goto err;
    if (BN_copy(A, n) == NULL)
        goto err;
    A->neg = 0;
    if (B->neg || (BN_ucmp(B, A) >= 0)) {
        if (!BN_nnmod(B, B, A, ctx))
            goto err;
    }
    sign = -1;
    /*-
     * From  B = a mod |n|,  A = |n|  it follows that
     *
     *      0 <= B < A,
     *     -sign*X*a  ==  B   (mod |n|),
     *      sign*Y*a  ==  A   (mod |n|).
     */

    if (BN_is_odd(n) && (BN_num_bits(n) <= (BN_BITS <= 32 ? 450 : 2048))) {
        /*
         * Binary inversion algorithm; requires odd modulus. This is faster
         * than the general algorithm if the modulus is sufficiently small
         * (about 400 .. 500 bits on 32-bit sytems, but much more on 64-bit
         * systems)
         */
        int shift;

        while (!BN_is_zero(B)) {
            /*-
             *      0 < B < |n|,
             *      0 < A <= |n|,
             * (1) -sign*X*a  ==  B   (mod |n|),
             * (2)  sign*Y*a  ==  A   (mod |n|)
             */

            /*
             * Now divide B by the maximum possible power of two in the
             * integers, and divide X by the same value mod |n|. When we're
             * done, (1) still holds.
             */
            shift = 0;
            while (!BN_is_bit_set(B, shift)) { /* note that 0 < B */
                shift++;

                if (BN_is_odd(X)) {
                    if (!BN_uadd(X, X, n))
                        goto err;
                }
                /*
                 * now X is even, so we can easily divide it by two
                 */
                if (!BN_rshift1(X, X))
                    goto err;
            }
            if (shift > 0) {
                if (!BN_rshift(B, B, shift))
                    goto err;
            }

            /*
             * Same for A and Y.  Afterwards, (2) still holds.
             */
            shift = 0;
            while (!BN_is_bit_set(A, shift)) { /* note that 0 < A */
                shift++;

                if (BN_is_odd(Y)) {
                    if (!BN_uadd(Y, Y, n))
                        goto err;
                }
                /* now Y is even */
                if (!BN_rshift1(Y, Y))
                    goto err;
            }
            if (shift > 0) {
                if (!BN_rshift(A, A, shift))
                    goto err;
            }

            /*-
             * We still have (1) and (2).
             * Both  A  and  B  are odd.
             * The following computations ensure that
             *
             *     0 <= B < |n|,
             *      0 < A < |n|,
             * (1) -sign*X*a  ==  B   (mod |n|),
             * (2)  sign*Y*a  ==  A   (mod |n|),
             *
             * and that either  A  or  B  is even in the next iteration.
             */
            if (BN_ucmp(B, A) >= 0) {
                /* -sign*(X + Y)*a == B - A  (mod |n|) */
                if (!BN_uadd(X, X, Y))
                    goto err;
                /*
                 * NB: we could use BN_mod_add_quick(X, X, Y, n), but that
                 * actually makes the algorithm slower
                 */
                if (!BN_usub(B, B, A))
                    goto err;
            } else {
                /*  sign*(X + Y)*a == A - B  (mod |n|) */
                if (!BN_uadd(Y, Y, X))
                    goto err;
                /*
                 * as above, BN_mod_add_quick(Y, Y, X, n) would slow things
                 * down
                 */
                if (!BN_usub(A, A, B))
                    goto err;
            }
        }
    } else {
        /* general inversion algorithm */

        while (!BN_is_zero(B)) {
            BIGNUM *tmp;

            /*-
             *      0 < B < A,
             * (*) -sign*X*a  ==  B   (mod |n|),
             *      sign*Y*a  ==  A   (mod |n|)
             */

            /* (D, M) := (A/B, A%B) ... */
            if (BN_num_bits(A) == BN_num_bits(B)) {
                if (!BN_one(D))
                    goto err;
                if (!BN_sub(M, A, B))
                    goto err;
            } else if (BN_num_bits(A) == BN_num_bits(B) + 1) {
                /* A/B is 1, 2, or 3 */
                if (!BN_lshift1(T, B))
                    goto err;
                if (BN_ucmp(A, T) < 0) {
                    /* A < 2*B, so D=1 */
                    if (!BN_one(D))
                        goto err;
                    if (!BN_sub(M, A, B))
                        goto err;
                } else {
                    /* A >= 2*B, so D=2 or D=3 */
                    if (!BN_sub(M, A, T))
                        goto err;
                    if (!BN_add(D, T, B))
                        goto err; /* use D (:= 3*B) as temp */
                    if (BN_ucmp(A, D) < 0) {
                        /* A < 3*B, so D=2 */
                        if (!BN_set_word(D, 2))
                            goto err;
                        /*
                         * M (= A - 2*B) already has the correct value
                         */
                    } else {
                        /* only D=3 remains */
                        if (!BN_set_word(D, 3))
                            goto err;
                        /*
                         * currently M = A - 2*B, but we need M = A - 3*B
                         */
                        if (!BN_sub(M, M, B))
                            goto err;
                    }
                }
            } else {
                if (!BN_div(D, M, A, B, ctx))
                    goto err;
            }

            /*-
             * Now
             *      A = D*B + M;
             * thus we have
             * (**)  sign*Y*a  ==  D*B + M   (mod |n|).
             */

            tmp = A;            /* keep the BIGNUM object, the value does not
                                 * matter */

            /* (A, B) := (B, A mod B) ... */
            A = B;
            B = M;
            /* ... so we have  0 <= B < A  again */

            /*-
             * Since the former  M  is now  B  and the former  B  is now  A,
             * (**) translates into
             *       sign*Y*a  ==  D*A + B    (mod |n|),
             * i.e.
             *       sign*Y*a - D*A  ==  B    (mod |n|).
             * Similarly, (*) translates into
             *      -sign*X*a  ==  A          (mod |n|).
             *
             * Thus,
             *   sign*Y*a + D*sign*X*a  ==  B  (mod |n|),
             * i.e.
             *        sign*(Y + D*X)*a  ==  B  (mod |n|).
             *
             * So if we set  (X, Y, sign) := (Y + D*X, X, -sign),  we arrive back at
             *      -sign*X*a  ==  B   (mod |n|),
             *       sign*Y*a  ==  A   (mod |n|).
             * Note that  X  and  Y  stay non-negative all the time.
             */

            /*
             * most of the time D is very small, so we can optimize tmp :=
             * D*X+Y
             */
            if (BN_is_one(D)) {
                if (!BN_add(tmp, X, Y))
                    goto err;
            } else {
                if (BN_is_word(D, 2)) {
                    if (!BN_lshift1(tmp, X))
                        goto err;
                } else if (BN_is_word(D, 4)) {
                    if (!BN_lshift(tmp, X, 2))
                        goto err;
                } else if (D->top == 1) {
                    if (!BN_copy(tmp, X))
                        goto err;
                    if (!BN_mul_word(tmp, D->d[0]))
                        goto err;
                } else {
                    if (!BN_mul(tmp, D, X, ctx))
                        goto err;
                }
                if (!BN_add(tmp, tmp, Y))
                    goto err;
            }

            M = Y;              /* keep the BIGNUM object, the value does not
                                 * matter */
            Y = X;
            X = tmp;
            sign = -sign;
        }
    }

    /*-
     * The while loop (Euclid's algorithm) ends when
     *      A == gcd(a,n);
     * we have
     *       sign*Y*a  ==  A  (mod |n|),
     * where  Y  is non-negative.
     */

    if (sign < 0) {
        if (!BN_sub(Y, n, Y))
            goto err;
    }
    /* Now  Y*a  ==  A  (mod |n|).  */

    if (BN_is_one(A)) {
        /* Y*a == 1  (mod |n|) */
        if (!Y->neg && BN_ucmp(Y, n) < 0) {
            if (!BN_copy(R, Y))
                goto err;
        } else {
            if (!BN_nnmod(R, Y, n, ctx))
                goto err;
        }
    } else {
        BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);
        goto err;
    }
    ret = R;
 err:
    if ((ret == NULL) && (in == NULL))
        BN_free(R);
    BN_CTX_end(ctx);
    bn_check_top(ret);
    return (ret);
}

/*
 * BN_mod_inverse_no_branch is a special version of BN_mod_inverse. It does
 * not contain branches that may leak sensitive information.
 */
static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
                                        const BIGNUM *a, const BIGNUM *n,
                                        BN_CTX *ctx)
{
    BIGNUM *A, *B, *X, *Y, *M, *D, *T, *R = NULL;
    BIGNUM local_A, local_B;
    BIGNUM *pA, *pB;
    BIGNUM *ret = NULL;
    int sign;

    bn_check_top(a);
    bn_check_top(n);

    BN_CTX_start(ctx);
    A = BN_CTX_get(ctx);
    B = BN_CTX_get(ctx);
    X = BN_CTX_get(ctx);
    D = BN_CTX_get(ctx);
    M = BN_CTX_get(ctx);
    Y = BN_CTX_get(ctx);
    T = BN_CTX_get(ctx);
    if (T == NULL)
        goto err;

    if (in == NULL)
        R = BN_new();
    else
        R = in;
    if (R == NULL)
        goto err;

    BN_one(X);
    BN_zero(Y);
    if (BN_copy(B, a) == NULL)
        goto err;
    if (BN_copy(A, n) == NULL)
        goto err;
    A->neg = 0;

    if (B->neg || (BN_ucmp(B, A) >= 0)) {
        /*
         * Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
         * BN_div_no_branch will be called eventually.
         */
        pB = &local_B;
        local_B.flags = 0;
        BN_with_flags(pB, B, BN_FLG_CONSTTIME);
        if (!BN_nnmod(B, pB, A, ctx))
            goto err;
    }
    sign = -1;
    /*-
     * From  B = a mod |n|,  A = |n|  it follows that
     *
     *      0 <= B < A,
     *     -sign*X*a  ==  B   (mod |n|),
     *      sign*Y*a  ==  A   (mod |n|).
     */

    while (!BN_is_zero(B)) {
        BIGNUM *tmp;

        /*-
         *      0 < B < A,
         * (*) -sign*X*a  ==  B   (mod |n|),
         *      sign*Y*a  ==  A   (mod |n|)
         */

        /*
         * Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
         * BN_div_no_branch will be called eventually.
         */
        pA = &local_A;
        local_A.flags = 0;
        BN_with_flags(pA, A, BN_FLG_CONSTTIME);

        /* (D, M) := (A/B, A%B) ... */
        if (!BN_div(D, M, pA, B, ctx))
            goto err;

        /*-
         * Now
         *      A = D*B + M;
         * thus we have
         * (**)  sign*Y*a  ==  D*B + M   (mod |n|).
         */

        tmp = A;                /* keep the BIGNUM object, the value does not
                                 * matter */

        /* (A, B) := (B, A mod B) ... */
        A = B;
        B = M;
        /* ... so we have  0 <= B < A  again */

        /*-
         * Since the former  M  is now  B  and the former  B  is now  A,
         * (**) translates into
         *       sign*Y*a  ==  D*A + B    (mod |n|),
         * i.e.
         *       sign*Y*a - D*A  ==  B    (mod |n|).
         * Similarly, (*) translates into
         *      -sign*X*a  ==  A          (mod |n|).
         *
         * Thus,
         *   sign*Y*a + D*sign*X*a  ==  B  (mod |n|),
         * i.e.
         *        sign*(Y + D*X)*a  ==  B  (mod |n|).
         *
         * So if we set  (X, Y, sign) := (Y + D*X, X, -sign),  we arrive back at
         *      -sign*X*a  ==  B   (mod |n|),
         *       sign*Y*a  ==  A   (mod |n|).
         * Note that  X  and  Y  stay non-negative all the time.
         */

        if (!BN_mul(tmp, D, X, ctx))
            goto err;
        if (!BN_add(tmp, tmp, Y))
            goto err;

        M = Y;                  /* keep the BIGNUM object, the value does not
                                 * matter */
        Y = X;
        X = tmp;
        sign = -sign;
    }

    /*-
     * The while loop (Euclid's algorithm) ends when
     *      A == gcd(a,n);
     * we have
     *       sign*Y*a  ==  A  (mod |n|),
     * where  Y  is non-negative.
     */

    if (sign < 0) {
        if (!BN_sub(Y, n, Y))
            goto err;
    }
    /* Now  Y*a  ==  A  (mod |n|).  */

    if (BN_is_one(A)) {
        /* Y*a == 1  (mod |n|) */
        if (!Y->neg && BN_ucmp(Y, n) < 0) {
            if (!BN_copy(R, Y))
                goto err;
        } else {
            if (!BN_nnmod(R, Y, n, ctx))
                goto err;
        }
    } else {
        BNerr(BN_F_BN_MOD_INVERSE_NO_BRANCH, BN_R_NO_INVERSE);
        goto err;
    }
    ret = R;
 err:
    if ((ret == NULL) && (in == NULL))
        BN_free(R);
    BN_CTX_end(ctx);
    bn_check_top(ret);
    return (ret);
}

Coverage Report

Created: 2022-11-30 06:20

Line	Count	Source (jump to first uncovered line)
1		/* crypto/bn/bn_gcd.c */
2		/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3		* All rights reserved.
4		*
5		* This package is an SSL implementation written
6		* by Eric Young (eay@cryptsoft.com).
7		* The implementation was written so as to conform with Netscapes SSL.
8		*
9		* This library is free for commercial and non-commercial use as long as
10		* the following conditions are aheared to. The following conditions
11		* apply to all code found in this distribution, be it the RC4, RSA,
12		* lhash, DES, etc., code; not just the SSL code. The SSL documentation
13		* included with this distribution is covered by the same copyright terms
14		* except that the holder is Tim Hudson (tjh@cryptsoft.com).
15		*
16		* Copyright remains Eric Young's, and as such any Copyright notices in
17		* the code are not to be removed.
18		* If this package is used in a product, Eric Young should be given attribution
19		* as the author of the parts of the library used.
20		* This can be in the form of a textual message at program startup or
21		* in documentation (online or textual) provided with the package.
22		*
23		* Redistribution and use in source and binary forms, with or without
24		* modification, are permitted provided that the following conditions
25		* are met:
26		* 1. Redistributions of source code must retain the copyright
27		* notice, this list of conditions and the following disclaimer.
28		* 2. Redistributions in binary form must reproduce the above copyright
29		* notice, this list of conditions and the following disclaimer in the
30		* documentation and/or other materials provided with the distribution.
31		* 3. All advertising materials mentioning features or use of this software
32		* must display the following acknowledgement:
33		* "This product includes cryptographic software written by
34		* Eric Young (eay@cryptsoft.com)"
35		* The word 'cryptographic' can be left out if the rouines from the library
36		* being used are not cryptographic related :-).
37		* 4. If you include any Windows specific code (or a derivative thereof) from
38		* the apps directory (application code) you must include an acknowledgement:
39		* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40		*
41		* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44		* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51		* SUCH DAMAGE.
52		*
53		* The licence and distribution terms for any publically available version or
54		* derivative of this code cannot be changed. i.e. this code cannot simply be
55		* copied and put under another distribution licence
56		* [including the GNU Public Licence.]
57		*/
58		/* ====================================================================
59		* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
60		*
61		* Redistribution and use in source and binary forms, with or without
62		* modification, are permitted provided that the following conditions
63		* are met:
64		*
65		* 1. Redistributions of source code must retain the above copyright
66		* notice, this list of conditions and the following disclaimer.
67		*
68		* 2. Redistributions in binary form must reproduce the above copyright
69		* notice, this list of conditions and the following disclaimer in
70		* the documentation and/or other materials provided with the
71		* distribution.
72		*
73		* 3. All advertising materials mentioning features or use of this
74		* software must display the following acknowledgment:
75		* "This product includes software developed by the OpenSSL Project
76		* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77		*
78		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79		* endorse or promote products derived from this software without
80		* prior written permission. For written permission, please contact
81		* openssl-core@openssl.org.
82		*
83		* 5. Products derived from this software may not be called "OpenSSL"
84		* nor may "OpenSSL" appear in their names without prior written
85		* permission of the OpenSSL Project.
86		*
87		* 6. Redistributions of any form whatsoever must retain the following
88		* acknowledgment:
89		* "This product includes software developed by the OpenSSL Project
90		* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91		*
92		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103		* OF THE POSSIBILITY OF SUCH DAMAGE.
104		* ====================================================================
105		*
106		* This product includes cryptographic software written by Eric Young
107		* (eay@cryptsoft.com). This product includes software written by Tim
108		* Hudson (tjh@cryptsoft.com).
109		*
110		*/
111
112		#include "cryptlib.h"
113		#include "bn_lcl.h"
114
115		static BIGNUM euclid(BIGNUM a, BIGNUM *b);
116
117		int BN_gcd(BIGNUM r, const BIGNUM in_a, const BIGNUM in_b, BN_CTX ctx)
118	0	{
119	0	BIGNUM a, b, *t;
120	0	int ret = 0;
121
122	0	bn_check_top(in_a);
123	0	bn_check_top(in_b);
124
125	0	BN_CTX_start(ctx);
126	0	a = BN_CTX_get(ctx);
127	0	b = BN_CTX_get(ctx);
128	0	if (a == NULL \|\| b == NULL)
129	0	goto err;
130
131	0	if (BN_copy(a, in_a) == NULL)
132	0	goto err;
133	0	if (BN_copy(b, in_b) == NULL)
134	0	goto err;
135	0	a->neg = 0;
136	0	b->neg = 0;
137
138	0	if (BN_cmp(a, b) < 0) {
139	0	t = a;
140	0	a = b;
141	0	b = t;
142	0	}
143	0	t = euclid(a, b);
144	0	if (t == NULL)
145	0	goto err;
146
147	0	if (BN_copy(r, t) == NULL)
148	0	goto err;
149	0	ret = 1;
150	0	err:
151	0	BN_CTX_end(ctx);
152	0	bn_check_top(r);
153	0	return (ret);
154	0	}
155
156		static BIGNUM euclid(BIGNUM a, BIGNUM *b)
157	0	{
158	0	BIGNUM *t;
159	0	int shifts = 0;
160
161	0	bn_check_top(a);
162	0	bn_check_top(b);
163
164		/* 0 <= b <= a */
165	0	while (!BN_is_zero(b)) {
166		/* 0 < b <= a */
167
168	0	if (BN_is_odd(a)) {
169	0	if (BN_is_odd(b)) {
170	0	if (!BN_sub(a, a, b))
171	0	goto err;
172	0	if (!BN_rshift1(a, a))
173	0	goto err;
174	0	if (BN_cmp(a, b) < 0) {
175	0	t = a;
176	0	a = b;
177	0	b = t;
178	0	}
179	0	} else { /* a odd - b even */
180
181	0	if (!BN_rshift1(b, b))
182	0	goto err;
183	0	if (BN_cmp(a, b) < 0) {
184	0	t = a;
185	0	a = b;
186	0	b = t;
187	0	}
188	0	}
189	0	} else { /* a is even */
190
191	0	if (BN_is_odd(b)) {
192	0	if (!BN_rshift1(a, a))
193	0	goto err;
194	0	if (BN_cmp(a, b) < 0) {
195	0	t = a;
196	0	a = b;
197	0	b = t;
198	0	}
199	0	} else { /* a even - b even */
200
201	0	if (!BN_rshift1(a, a))
202	0	goto err;
203	0	if (!BN_rshift1(b, b))
204	0	goto err;
205	0	shifts++;
206	0	}
207	0	}
208		/* 0 <= b <= a */
209	0	}
210
211	0	if (shifts) {
212	0	if (!BN_lshift(a, a, shifts))
213	0	goto err;
214	0	}
215	0	bn_check_top(a);
216	0	return (a);
217	0	err:
218	0	return (NULL);
219	0	}
220
221		/* solves ax == 1 (mod n) */
222		static BIGNUM BN_mod_inverse_no_branch(BIGNUM in,
223		const BIGNUM a, const BIGNUM n,
224		BN_CTX *ctx);
225
226		BIGNUM BN_mod_inverse(BIGNUM in,
227		const BIGNUM a, const BIGNUM n, BN_CTX *ctx)
228	0	{
229	0	BIGNUM A, B, X, Y, M, D, T, R = NULL;
230	0	BIGNUM *ret = NULL;
231	0	int sign;
232
233	0	if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
234	0	\|\| (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
235	0	return BN_mod_inverse_no_branch(in, a, n, ctx);
236	0	}
237
238	0	bn_check_top(a);
239	0	bn_check_top(n);
240
241	0	BN_CTX_start(ctx);
242	0	A = BN_CTX_get(ctx);
243	0	B = BN_CTX_get(ctx);
244	0	X = BN_CTX_get(ctx);
245	0	D = BN_CTX_get(ctx);
246	0	M = BN_CTX_get(ctx);
247	0	Y = BN_CTX_get(ctx);
248	0	T = BN_CTX_get(ctx);
249	0	if (T == NULL)
250	0	goto err;
251
252	0	if (in == NULL)
253	0	R = BN_new();
254	0	else
255	0	R = in;
256	0	if (R == NULL)
257	0	goto err;
258
259	0	BN_one(X);
260	0	BN_zero(Y);
261	0	if (BN_copy(B, a) == NULL)
262	0	goto err;
263	0	if (BN_copy(A, n) == NULL)
264	0	goto err;
265	0	A->neg = 0;
266	0	if (B->neg \|\| (BN_ucmp(B, A) >= 0)) {
267	0	if (!BN_nnmod(B, B, A, ctx))
268	0	goto err;
269	0	}
270	0	sign = -1;
271		/*-
272		* From B = a mod \|n\|, A = \|n\| it follows that
273		*
274		* 0 <= B < A,
275		* -signXa == B (mod \|n\|),
276		* signYa == A (mod \|n\|).
277		*/
278
279	0	if (BN_is_odd(n) && (BN_num_bits(n) <= (BN_BITS <= 32 ? 450 : 2048))) {
280		/*
281		* Binary inversion algorithm; requires odd modulus. This is faster
282		* than the general algorithm if the modulus is sufficiently small
283		* (about 400 .. 500 bits on 32-bit sytems, but much more on 64-bit
284		* systems)
285		*/
286	0	int shift;
287
288	0	while (!BN_is_zero(B)) {
289		/*-
290		* 0 < B < \|n\|,
291		* 0 < A <= \|n\|,
292		* (1) -signXa == B (mod \|n\|),
293		* (2) signYa == A (mod \|n\|)
294		*/
295
296		/*
297		* Now divide B by the maximum possible power of two in the
298		* integers, and divide X by the same value mod \|n\|. When we're
299		* done, (1) still holds.
300		*/
301	0	shift = 0;
302	0	while (!BN_is_bit_set(B, shift)) { /* note that 0 < B */
303	0	shift++;
304
305	0	if (BN_is_odd(X)) {
306	0	if (!BN_uadd(X, X, n))
307	0	goto err;
308	0	}
309		/*
310		* now X is even, so we can easily divide it by two
311		*/
312	0	if (!BN_rshift1(X, X))
313	0	goto err;
314	0	}
315	0	if (shift > 0) {
316	0	if (!BN_rshift(B, B, shift))
317	0	goto err;
318	0	}
319
320		/*
321		* Same for A and Y. Afterwards, (2) still holds.
322		*/
323	0	shift = 0;
324	0	while (!BN_is_bit_set(A, shift)) { /* note that 0 < A */
325	0	shift++;
326
327	0	if (BN_is_odd(Y)) {
328	0	if (!BN_uadd(Y, Y, n))
329	0	goto err;
330	0	}
331		/* now Y is even */
332	0	if (!BN_rshift1(Y, Y))
333	0	goto err;
334	0	}
335	0	if (shift > 0) {
336	0	if (!BN_rshift(A, A, shift))
337	0	goto err;
338	0	}
339
340		/*-
341		* We still have (1) and (2).
342		* Both A and B are odd.
343		* The following computations ensure that
344		*
345		* 0 <= B < \|n\|,
346		* 0 < A < \|n\|,
347		* (1) -signXa == B (mod \|n\|),
348		* (2) signYa == A (mod \|n\|),
349		*
350		* and that either A or B is even in the next iteration.
351		*/
352	0	if (BN_ucmp(B, A) >= 0) {
353		/* -sign(X + Y)a == B - A (mod \|n\|) */
354	0	if (!BN_uadd(X, X, Y))
355	0	goto err;
356		/*
357		* NB: we could use BN_mod_add_quick(X, X, Y, n), but that
358		* actually makes the algorithm slower
359		*/
360	0	if (!BN_usub(B, B, A))
361	0	goto err;
362	0	} else {
363		/* sign(X + Y)a == A - B (mod \|n\|) */
364	0	if (!BN_uadd(Y, Y, X))
365	0	goto err;
366		/*
367		* as above, BN_mod_add_quick(Y, Y, X, n) would slow things
368		* down
369		*/
370	0	if (!BN_usub(A, A, B))
371	0	goto err;
372	0	}
373	0	}
374	0	} else {
375		/* general inversion algorithm */
376
377	0	while (!BN_is_zero(B)) {
378	0	BIGNUM *tmp;
379
380		/*-
381		* 0 < B < A,
382		* () -signX*a == B (mod \|n\|),
383		* signYa == A (mod \|n\|)
384		*/
385
386		/* (D, M) := (A/B, A%B) ... */
387	0	if (BN_num_bits(A) == BN_num_bits(B)) {
388	0	if (!BN_one(D))
389	0	goto err;
390	0	if (!BN_sub(M, A, B))
391	0	goto err;
392	0	} else if (BN_num_bits(A) == BN_num_bits(B) + 1) {
393		/* A/B is 1, 2, or 3 */
394	0	if (!BN_lshift1(T, B))
395	0	goto err;
396	0	if (BN_ucmp(A, T) < 0) {
397		/* A < 2B, so D=1 /
398	0	if (!BN_one(D))
399	0	goto err;
400	0	if (!BN_sub(M, A, B))
401	0	goto err;
402	0	} else {
403		/* A >= 2B, so D=2 or D=3 /
404	0	if (!BN_sub(M, A, T))
405	0	goto err;
406	0	if (!BN_add(D, T, B))
407	0	goto err; /* use D (:= 3B) as temp /
408	0	if (BN_ucmp(A, D) < 0) {
409		/* A < 3B, so D=2 /
410	0	if (!BN_set_word(D, 2))
411	0	goto err;
412		/*
413		* M (= A - 2*B) already has the correct value
414		*/
415	0	} else {
416		/* only D=3 remains */
417	0	if (!BN_set_word(D, 3))
418	0	goto err;
419		/*
420		* currently M = A - 2B, but we need M = A - 3B
421		*/
422	0	if (!BN_sub(M, M, B))
423	0	goto err;
424	0	}
425	0	}
426	0	} else {
427	0	if (!BN_div(D, M, A, B, ctx))
428	0	goto err;
429	0	}
430
431		/*-
432		* Now
433		* A = D*B + M;
434		* thus we have
435		* (*) signYa == DB + M (mod \|n\|).
436		*/
437
438	0	tmp = A; /* keep the BIGNUM object, the value does not
439		* matter */
440
441		/* (A, B) := (B, A mod B) ... */
442	0	A = B;
443	0	B = M;
444		/* ... so we have 0 <= B < A again */
445
446		/*-
447		* Since the former M is now B and the former B is now A,
448		* (**) translates into
449		* signYa == D*A + B (mod \|n\|),
450		* i.e.
451		* signYa - D*A == B (mod \|n\|).
452		* Similarly, (*) translates into
453		* -signXa == A (mod \|n\|).
454		*
455		* Thus,
456		* signYa + DsignX*a == B (mod \|n\|),
457		* i.e.
458		* sign(Y + DX)*a == B (mod \|n\|).
459		*
460		* So if we set (X, Y, sign) := (Y + D*X, X, -sign), we arrive back at
461		* -signXa == B (mod \|n\|),
462		* signYa == A (mod \|n\|).
463		* Note that X and Y stay non-negative all the time.
464		*/
465
466		/*
467		* most of the time D is very small, so we can optimize tmp :=
468		* D*X+Y
469		*/
470	0	if (BN_is_one(D)) {
471	0	if (!BN_add(tmp, X, Y))
472	0	goto err;
473	0	} else {
474	0	if (BN_is_word(D, 2)) {
475	0	if (!BN_lshift1(tmp, X))
476	0	goto err;
477	0	} else if (BN_is_word(D, 4)) {
478	0	if (!BN_lshift(tmp, X, 2))
479	0	goto err;
480	0	} else if (D->top == 1) {
481	0	if (!BN_copy(tmp, X))
482	0	goto err;
483	0	if (!BN_mul_word(tmp, D->d[0]))
484	0	goto err;
485	0	} else {
486	0	if (!BN_mul(tmp, D, X, ctx))
487	0	goto err;
488	0	}
489	0	if (!BN_add(tmp, tmp, Y))
490	0	goto err;
491	0	}
492
493	0	M = Y; /* keep the BIGNUM object, the value does not
494		* matter */
495	0	Y = X;
496	0	X = tmp;
497	0	sign = -sign;
498	0	}
499	0	}
500
501		/*-
502		* The while loop (Euclid's algorithm) ends when
503		* A == gcd(a,n);
504		* we have
505		* signYa == A (mod \|n\|),
506		* where Y is non-negative.
507		*/
508
509	0	if (sign < 0) {
510	0	if (!BN_sub(Y, n, Y))
511	0	goto err;
512	0	}
513		/* Now Ya == A (mod \|n\|). /
514
515	0	if (BN_is_one(A)) {
516		/* Ya == 1 (mod \|n\|) /
517	0	if (!Y->neg && BN_ucmp(Y, n) < 0) {
518	0	if (!BN_copy(R, Y))
519	0	goto err;
520	0	} else {
521	0	if (!BN_nnmod(R, Y, n, ctx))
522	0	goto err;
523	0	}
524	0	} else {
525	0	BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);
526	0	goto err;
527	0	}
528	0	ret = R;
529	0	err:
530	0	if ((ret == NULL) && (in == NULL))
531	0	BN_free(R);
532	0	BN_CTX_end(ctx);
533	0	bn_check_top(ret);
534	0	return (ret);
535	0	}
536
537		/*
538		* BN_mod_inverse_no_branch is a special version of BN_mod_inverse. It does
539		* not contain branches that may leak sensitive information.
540		*/
541		static BIGNUM BN_mod_inverse_no_branch(BIGNUM in,
542		const BIGNUM a, const BIGNUM n,
543		BN_CTX *ctx)
544	0	{
545	0	BIGNUM A, B, X, Y, M, D, T, R = NULL;
546	0	BIGNUM local_A, local_B;
547	0	BIGNUM pA, pB;
548	0	BIGNUM *ret = NULL;
549	0	int sign;
550
551	0	bn_check_top(a);
552	0	bn_check_top(n);
553
554	0	BN_CTX_start(ctx);
555	0	A = BN_CTX_get(ctx);
556	0	B = BN_CTX_get(ctx);
557	0	X = BN_CTX_get(ctx);
558	0	D = BN_CTX_get(ctx);
559	0	M = BN_CTX_get(ctx);
560	0	Y = BN_CTX_get(ctx);
561	0	T = BN_CTX_get(ctx);
562	0	if (T == NULL)
563	0	goto err;
564
565	0	if (in == NULL)
566	0	R = BN_new();
567	0	else
568	0	R = in;
569	0	if (R == NULL)
570	0	goto err;
571
572	0	BN_one(X);
573	0	BN_zero(Y);
574	0	if (BN_copy(B, a) == NULL)
575	0	goto err;
576	0	if (BN_copy(A, n) == NULL)
577	0	goto err;
578	0	A->neg = 0;
579
580	0	if (B->neg \|\| (BN_ucmp(B, A) >= 0)) {
581		/*
582		* Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
583		* BN_div_no_branch will be called eventually.
584		*/
585	0	pB = &local_B;
586	0	local_B.flags = 0;
587	0	BN_with_flags(pB, B, BN_FLG_CONSTTIME);
588	0	if (!BN_nnmod(B, pB, A, ctx))
589	0	goto err;
590	0	}
591	0	sign = -1;
592		/*-
593		* From B = a mod \|n\|, A = \|n\| it follows that
594		*
595		* 0 <= B < A,
596		* -signXa == B (mod \|n\|),
597		* signYa == A (mod \|n\|).
598		*/
599
600	0	while (!BN_is_zero(B)) {
601	0	BIGNUM *tmp;
602
603		/*-
604		* 0 < B < A,
605		* () -signX*a == B (mod \|n\|),
606		* signYa == A (mod \|n\|)
607		*/
608
609		/*
610		* Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
611		* BN_div_no_branch will be called eventually.
612		*/
613	0	pA = &local_A;
614	0	local_A.flags = 0;
615	0	BN_with_flags(pA, A, BN_FLG_CONSTTIME);
616
617		/* (D, M) := (A/B, A%B) ... */
618	0	if (!BN_div(D, M, pA, B, ctx))
619	0	goto err;
620
621		/*-
622		* Now
623		* A = D*B + M;
624		* thus we have
625		* (*) signYa == DB + M (mod \|n\|).
626		*/
627
628	0	tmp = A; /* keep the BIGNUM object, the value does not
629		* matter */
630
631		/* (A, B) := (B, A mod B) ... */
632	0	A = B;
633	0	B = M;
634		/* ... so we have 0 <= B < A again */
635
636		/*-
637		* Since the former M is now B and the former B is now A,
638		* (**) translates into
639		* signYa == D*A + B (mod \|n\|),
640		* i.e.
641		* signYa - D*A == B (mod \|n\|).
642		* Similarly, (*) translates into
643		* -signXa == A (mod \|n\|).
644		*
645		* Thus,
646		* signYa + DsignX*a == B (mod \|n\|),
647		* i.e.
648		* sign(Y + DX)*a == B (mod \|n\|).
649		*
650		* So if we set (X, Y, sign) := (Y + D*X, X, -sign), we arrive back at
651		* -signXa == B (mod \|n\|),
652		* signYa == A (mod \|n\|).
653		* Note that X and Y stay non-negative all the time.
654		*/
655
656	0	if (!BN_mul(tmp, D, X, ctx))
657	0	goto err;
658	0	if (!BN_add(tmp, tmp, Y))
659	0	goto err;
660
661	0	M = Y; /* keep the BIGNUM object, the value does not
662		* matter */
663	0	Y = X;
664	0	X = tmp;
665	0	sign = -sign;
666	0	}
667
668		/*-
669		* The while loop (Euclid's algorithm) ends when
670		* A == gcd(a,n);
671		* we have
672		* signYa == A (mod \|n\|),
673		* where Y is non-negative.
674		*/
675
676	0	if (sign < 0) {
677	0	if (!BN_sub(Y, n, Y))
678	0	goto err;
679	0	}
680		/* Now Ya == A (mod \|n\|). /
681
682	0	if (BN_is_one(A)) {
683		/* Ya == 1 (mod \|n\|) /
684	0	if (!Y->neg && BN_ucmp(Y, n) < 0) {
685	0	if (!BN_copy(R, Y))
686	0	goto err;
687	0	} else {
688	0	if (!BN_nnmod(R, Y, n, ctx))
689	0	goto err;
690	0	}
691	0	} else {
692	0	BNerr(BN_F_BN_MOD_INVERSE_NO_BRANCH, BN_R_NO_INVERSE);
693	0	goto err;
694	0	}
695	0	ret = R;
696	0	err:
697	0	if ((ret == NULL) && (in == NULL))
698	0	BN_free(R);
699	0	BN_CTX_end(ctx);
700	0	bn_check_top(ret);
701	0	return (ret);
702	0	}