Ensure that x**0 mod 1 = 0.

[openssl.git] / crypto / bn / bn_exp.c

diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c
index 5adb441870235a3d72bed617aa9965c288b09840..070fd31f92eecd706647d4383b42bf9092f34db0 100644 (file)
--- a/crypto/bn/bn_exp.c
+++ b/crypto/bn/bn_exp.c
@@ -493,6 +493,9 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                r->d[0] = (0-m->d[0])&BN_MASK2;
                for(i=1;i<j;i++) r->d[i] = (~m->d[i])&BN_MASK2;
                r->top = j;
+               /* Upper words will be zero if the corresponding words of 'm'
+                * were 0xfff[...], so decrement r->top accordingly. */
+               bn_correct_top(r);
                }
        else
 #endif
@@ -690,8 +693,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         * RSAZ exponentiation. For further information see
         * crypto/bn/rsaz_exp.c and accompanying assembly modules.
         */
-       if (((OPENSSL_ia32cap_P[2]&0x80100) != 0x80100) /* check for MULX/AD*X */
-           && (16 == a->top) && (16 == p->top) && (BN_num_bits(m) == 1024)
+       if ((16 == a->top) && (16 == p->top) && (BN_num_bits(m) == 1024)
            && rsaz_avx2_eligible())
                {
                if (NULL == bn_wexpand(rr, 16)) goto err;
@@ -906,7 +908,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
     /* Dedicated window==4 case improves 512-bit RSA sign by ~15%, but as
      * 512-bit RSA is hardly relevant, we omit it to spare size... */ 
-    if (window==5)
+    if (window==5 && top>1)
        {
        void bn_mul_mont_gather5(BN_ULONG *rp,const BN_ULONG *ap,
                        const void *table,const BN_ULONG *np,
@@ -1137,7 +1139,14 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
        bits = BN_num_bits(p);
        if (bits == 0)
                {
-               ret = BN_one(rr);
+               /* x**0 mod 1 is still zero. */
+               if (BN_is_one(m))
+                       {
+                       ret = 1;
+                       BN_zero(rr);
+                       }
+               else
+                       ret = BN_one(rr);
                return ret;
                }
        if (a == 0)