- }
-
- for (i = 0; i < num0; i++) {
- BN_bntest_rand(a, 40 + i * 10, 0, 0);
- a->neg = rand_neg();
- BN_sqr(c, a, ctx);
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " * ");
- BN_print(bp, a);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, c);
- BIO_puts(bp, "\n");
- }
- BN_div(d, e, c, a, ctx);
- BN_sub(d, d, a);
- if (!BN_is_zero(d) || !BN_is_zero(e)) {
- fprintf(stderr, "Square test failed!\n");
- goto err;
- }
- }
-
- /* Regression test for a BN_sqr overflow bug. */
- BN_hex2bn(&a,
- "80000000000000008000000000000001"
- "FFFFFFFFFFFFFFFE0000000000000000");
- BN_sqr(c, a, ctx);
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " * ");
- BN_print(bp, a);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, c);
- BIO_puts(bp, "\n");
- }
- BN_mul(d, a, a, ctx);
- if (BN_cmp(c, d)) {
- fprintf(stderr, "Square test failed: BN_sqr and BN_mul produce "
- "different results!\n");
- goto err;
- }
-
- /* Regression test for a BN_sqr overflow bug. */
- BN_hex2bn(&a,
- "80000000000000000000000080000001"
- "FFFFFFFE000000000000000000000000");
- BN_sqr(c, a, ctx);
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " * ");
- BN_print(bp, a);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, c);
- BIO_puts(bp, "\n");
- }
- BN_mul(d, a, a, ctx);
- if (BN_cmp(c, d)) {
- fprintf(stderr, "Square test failed: BN_sqr and BN_mul produce "
- "different results!\n");
- goto err;
- }
- ret = 1;
- err:
- BN_free(a);
- BN_free(c);
- BN_free(d);
- BN_free(e);
- return ret;
-}
-
-int test_mont(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *b, *c, *d, *A, *B;
- BIGNUM *n;
- int i;
- BN_MONT_CTX *mont;
-
- a = BN_new();
- b = BN_new();
- c = BN_new();
- d = BN_new();
- A = BN_new();
- B = BN_new();
- n = BN_new();
-
- mont = BN_MONT_CTX_new();
- if (mont == NULL)
- return 0;
-
- BN_zero(n);
- if (BN_MONT_CTX_set(mont, n, ctx)) {
- fprintf(stderr, "BN_MONT_CTX_set succeeded for zero modulus!\n");
- return 0;
- }
-
- BN_set_word(n, 16);
- if (BN_MONT_CTX_set(mont, n, ctx)) {
- fprintf(stderr, "BN_MONT_CTX_set succeeded for even modulus!\n");
- return 0;
- }
-
- BN_bntest_rand(a, 100, 0, 0);
- BN_bntest_rand(b, 100, 0, 0);
- for (i = 0; i < num2; i++) {
- int bits = (200 * (i + 1)) / num2;
-
- if (bits == 0)
- continue;
- BN_bntest_rand(n, bits, 0, 1);
- BN_MONT_CTX_set(mont, n, ctx);
-
- BN_nnmod(a, a, n, ctx);
- BN_nnmod(b, b, n, ctx);
-
- BN_to_montgomery(A, a, mont, ctx);
- BN_to_montgomery(B, b, mont, ctx);
-
- BN_mod_mul_montgomery(c, A, B, mont, ctx);
- BN_from_montgomery(A, c, mont, ctx);
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " * ");
- BN_print(bp, b);
- BIO_puts(bp, " % ");
- BN_print(bp, &mont->N);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, A);
- BIO_puts(bp, "\n");
- }
- BN_mod_mul(d, a, b, n, ctx);
- BN_sub(d, d, A);
- if (!BN_is_zero(d)) {
- fprintf(stderr, "Montgomery multiplication test failed!\n");
- return 0;
- }
- }
- BN_MONT_CTX_free(mont);
- BN_free(a);
- BN_free(b);
- BN_free(c);
- BN_free(d);
- BN_free(A);
- BN_free(B);
- BN_free(n);
- return (1);
-}
-
-int test_mod(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *b, *c, *d, *e;
- int i;
-
- a = BN_new();
- b = BN_new();
- c = BN_new();
- d = BN_new();
- e = BN_new();
-
- BN_bntest_rand(a, 1024, 0, 0);
- for (i = 0; i < num0; i++) {
- BN_bntest_rand(b, 450 + i * 10, 0, 0);
- a->neg = rand_neg();
- b->neg = rand_neg();
- BN_mod(c, a, b, ctx);
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " % ");
- BN_print(bp, b);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, c);
- BIO_puts(bp, "\n");
- }
- BN_div(d, e, a, b, ctx);
- BN_sub(e, e, c);
- if (!BN_is_zero(e)) {
- fprintf(stderr, "Modulo test failed!\n");
- return 0;
- }
- }
- BN_free(a);
- BN_free(b);
- BN_free(c);
- BN_free(d);
- BN_free(e);
- return (1);
-}
-
-int test_mod_mul(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *b, *c, *d, *e;
- int i, j;
-
- a = BN_new();
- b = BN_new();
- c = BN_new();
- d = BN_new();
- e = BN_new();
-
- BN_one(a);
- BN_one(b);
- BN_zero(c);
- if (BN_mod_mul(e, a, b, c, ctx)) {
- fprintf(stderr, "BN_mod_mul with zero modulus succeeded!\n");
- return 0;
- }
-
- for (j = 0; j < 3; j++) {
- BN_bntest_rand(c, 1024, 0, 0);
- for (i = 0; i < num0; i++) {
- BN_bntest_rand(a, 475 + i * 10, 0, 0);
- BN_bntest_rand(b, 425 + i * 11, 0, 0);
- a->neg = rand_neg();
- b->neg = rand_neg();
- if (!BN_mod_mul(e, a, b, c, ctx)) {
- unsigned long l;
-
- while ((l = ERR_get_error()))
- fprintf(stderr, "ERROR:%s\n", ERR_error_string(l, NULL));
- EXIT(1);
- }
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " * ");
- BN_print(bp, b);
- BIO_puts(bp, " % ");
- BN_print(bp, c);
- if ((a->neg ^ b->neg) && !BN_is_zero(e)) {
- /*
- * If (a*b) % c is negative, c must be added in order
- * to obtain the normalized remainder (new with
- * OpenSSL 0.9.7, previous versions of BN_mod_mul
- * could generate negative results)
- */
- BIO_puts(bp, " + ");
- BN_print(bp, c);
- }
- BIO_puts(bp, " - ");
- }
- BN_print(bp, e);
- BIO_puts(bp, "\n");
- }
- BN_mul(d, a, b, ctx);
- BN_sub(d, d, e);
- BN_div(a, b, d, c, ctx);
- if (!BN_is_zero(b)) {
- fprintf(stderr, "Modulo multiply test failed!\n");
- ERR_print_errors_fp(stderr);
- return 0;
- }
- }
- }
- BN_free(a);
- BN_free(b);
- BN_free(c);
- BN_free(d);
- BN_free(e);
- return (1);
-}
-
-int test_mod_exp(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *b, *c, *d, *e;
- int i;
-
- a = BN_new();
- b = BN_new();
- c = BN_new();
- d = BN_new();
- e = BN_new();
-
- BN_one(a);
- BN_one(b);
- BN_zero(c);
- if (BN_mod_exp(d, a, b, c, ctx)) {
- fprintf(stderr, "BN_mod_exp with zero modulus succeeded!\n");
- return 0;
- }
-
- BN_bntest_rand(c, 30, 0, 1); /* must be odd for montgomery */
- for (i = 0; i < num2; i++) {
- BN_bntest_rand(a, 20 + i * 5, 0, 0);
- BN_bntest_rand(b, 2 + i, 0, 0);
-
- if (!BN_mod_exp(d, a, b, c, ctx))
- return (0);
-
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " ^ ");
- BN_print(bp, b);
- BIO_puts(bp, " % ");
- BN_print(bp, c);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, d);
- BIO_puts(bp, "\n");
- }
- BN_exp(e, a, b, ctx);
- BN_sub(e, e, d);
- BN_div(a, b, e, c, ctx);
- if (!BN_is_zero(b)) {
- fprintf(stderr, "Modulo exponentiation test failed!\n");
- return 0;
- }
- }
-
- /* Regression test for carry propagation bug in sqr8x_reduction */
- BN_hex2bn(&a, "050505050505");
- BN_hex2bn(&b, "02");
- BN_hex2bn(&c,
- "4141414141414141414141274141414141414141414141414141414141414141"
- "4141414141414141414141414141414141414141414141414141414141414141"
- "4141414141414141414141800000000000000000000000000000000000000000"
- "0000000000000000000000000000000000000000000000000000000000000000"
- "0000000000000000000000000000000000000000000000000000000000000000"
- "0000000000000000000000000000000000000000000000000000000001");
- BN_mod_exp(d, a, b, c, ctx);
- BN_mul(e, a, a, ctx);
- if (BN_cmp(d, e)) {
- fprintf(stderr, "BN_mod_exp and BN_mul produce different results!\n");
- return 0;
- }
-
- BN_free(a);
- BN_free(b);
- BN_free(c);
- BN_free(d);
- BN_free(e);
- return (1);
-}
-
-int test_mod_exp_mont_consttime(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *b, *c, *d, *e;
- int i;
-
- a = BN_new();
- b = BN_new();
- c = BN_new();
- d = BN_new();
- e = BN_new();
-
- BN_one(a);
- BN_one(b);
- BN_zero(c);
- if (BN_mod_exp_mont_consttime(d, a, b, c, ctx, NULL)) {
- fprintf(stderr, "BN_mod_exp_mont_consttime with zero modulus "
- "succeeded\n");
- return 0;
- }
-
- BN_set_word(c, 16);
- if (BN_mod_exp_mont_consttime(d, a, b, c, ctx, NULL)) {
- fprintf(stderr, "BN_mod_exp_mont_consttime with even modulus "
- "succeeded\n");
- return 0;
- }
-
- BN_bntest_rand(c, 30, 0, 1); /* must be odd for montgomery */
- for (i = 0; i < num2; i++) {
- BN_bntest_rand(a, 20 + i * 5, 0, 0);
- BN_bntest_rand(b, 2 + i, 0, 0);
-
- if (!BN_mod_exp_mont_consttime(d, a, b, c, ctx, NULL))
- return (00);
-
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " ^ ");
- BN_print(bp, b);
- BIO_puts(bp, " % ");
- BN_print(bp, c);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, d);
- BIO_puts(bp, "\n");
- }
- BN_exp(e, a, b, ctx);
- BN_sub(e, e, d);
- BN_div(a, b, e, c, ctx);
- if (!BN_is_zero(b)) {
- fprintf(stderr, "Modulo exponentiation test failed!\n");
- return 0;
- }
- }
- BN_free(a);
- BN_free(b);
- BN_free(c);
- BN_free(d);
- BN_free(e);
- return (1);
-}
-
-/*
- * Test constant-time modular exponentiation with 1024-bit inputs, which on
- * x86_64 cause a different code branch to be taken.
- */
-int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *p, *m, *d, *e;
- BN_MONT_CTX *mont;
-
- a = BN_new();
- p = BN_new();
- m = BN_new();
- d = BN_new();
- e = BN_new();
- mont = BN_MONT_CTX_new();
-
- BN_bntest_rand(m, 1024, 0, 1); /* must be odd for montgomery */
- /* Zero exponent */
- BN_bntest_rand(a, 1024, 0, 0);
- BN_zero(p);
- if (!BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))
- return 0;
- if (!BN_is_one(d)) {
- fprintf(stderr, "Modular exponentiation test failed!\n");
- return 0;
- }
- /* Zero input */
- BN_bntest_rand(p, 1024, 0, 0);
- BN_zero(a);
- if (!BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))
- return 0;
- if (!BN_is_zero(d)) {
- fprintf(stderr, "Modular exponentiation test failed!\n");
- return 0;
- }
- /*
- * Craft an input whose Montgomery representation is 1, i.e., shorter
- * than the modulus m, in order to test the const time precomputation
- * scattering/gathering.
- */
- BN_one(a);
- BN_MONT_CTX_set(mont, m, ctx);
- if (!BN_from_montgomery(e, a, mont, ctx))
- return 0;
- if (!BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))
- return 0;
- if (!BN_mod_exp_simple(a, e, p, m, ctx))
- return 0;
- if (BN_cmp(a, d) != 0) {
- fprintf(stderr, "Modular exponentiation test failed!\n");
- return 0;
- }
- /* Finally, some regular test vectors. */
- BN_bntest_rand(e, 1024, 0, 0);
- if (!BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))
- return 0;
- if (!BN_mod_exp_simple(a, e, p, m, ctx))
- return 0;
- if (BN_cmp(a, d) != 0) {
- fprintf(stderr, "Modular exponentiation test failed!\n");
- return 0;
- }
- BN_MONT_CTX_free(mont);
- BN_free(a);
- BN_free(p);
- BN_free(m);
- BN_free(d);
- BN_free(e);
- return (1);
-}
-
-int test_exp(BIO *bp, BN_CTX *ctx)
-{
- BIGNUM *a, *b, *d, *e, *one;
- int i;
-
- a = BN_new();
- b = BN_new();
- d = BN_new();
- e = BN_new();
- one = BN_new();
- BN_one(one);
-
- for (i = 0; i < num2; i++) {
- BN_bntest_rand(a, 20 + i * 5, 0, 0);
- BN_bntest_rand(b, 2 + i, 0, 0);
-
- if (BN_exp(d, a, b, ctx) <= 0)
- return (0);
-
- if (bp != NULL) {
- if (!results) {
- BN_print(bp, a);
- BIO_puts(bp, " ^ ");
- BN_print(bp, b);
- BIO_puts(bp, " - ");
- }
- BN_print(bp, d);
- BIO_puts(bp, "\n");
- }
- BN_one(e);
- for (; !BN_is_zero(b); BN_sub(b, b, one))
- BN_mul(e, e, a, ctx);
- BN_sub(e, e, d);
- if (!BN_is_zero(e)) {
- fprintf(stderr, "Exponentiation test failed!\n");
- return 0;
- }
- }
- BN_free(a);
- BN_free(b);
- BN_free(d);
- BN_free(e);
- BN_free(one);
- return (1);
-}
-
-#ifndef OPENSSL_NO_EC2M
-int test_gf2m_add(BIO *bp)
-{
- BIGNUM *a, *b, *c;
- int i, ret = 0;
-
- a = BN_new();
- b = BN_new();
- c = BN_new();
-
- for (i = 0; i < num0; i++) {
- BN_rand(a, 512, 0, 0);
- BN_copy(b, BN_value_one());
- a->neg = rand_neg();
- b->neg = rand_neg();
- BN_GF2m_add(c, a, b);
- /* Test that two added values have the correct parity. */
- if ((BN_is_odd(a) && BN_is_odd(c))
- || (!BN_is_odd(a) && !BN_is_odd(c))) {
- fprintf(stderr, "GF(2^m) addition test (a) failed!\n");
- goto err;
- }
- BN_GF2m_add(c, c, c);
- /* Test that c + c = 0. */
- if (!BN_is_zero(c)) {
- fprintf(stderr, "GF(2^m) addition test (b) failed!\n");
- goto err;
- }
- }
- ret = 1;
- err:
- BN_free(a);
- BN_free(b);
- BN_free(c);
- return ret;
-}
-
-int test_gf2m_mod(BIO *bp)
-{
- BIGNUM *a, *b[2], *c, *d, *e;
- int i, j, ret = 0;
- int p0[] = { 163, 7, 6, 3, 0, -1 };
- int p1[] = { 193, 15, 0, -1 };
-
- a = BN_new();
- b[0] = BN_new();
- b[1] = BN_new();
- c = BN_new();
- d = BN_new();
- e = BN_new();