crypto/bn/bn_nist.c

   1 /* crypto/bn/bn_nist.c */
   2 /* ====================================================================
   3  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the
  15  *    distribution.
  16  *
  17  * 3. All advertising materials mentioning features or use of this
  18  *    software must display the following acknowledgment:
  19  *    "This product includes software developed by the OpenSSL Project
  20  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  21  *
  22  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  23  *    endorse or promote products derived from this software without
  24  *    prior written permission. For written permission, please contact
  25  *    openssl-core@openssl.org.
  26  *
  27  * 5. Products derived from this software may not be called "OpenSSL"
  28  *    nor may "OpenSSL" appear in their names without prior written
  29  *    permission of the OpenSSL Project.
  30  *
  31  * 6. Redistributions of any form whatsoever must retain the following
  32  *    acknowledgment:
  33  *    "This product includes software developed by the OpenSSL Project
  34  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  37  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  39  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  40  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  41  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  42  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  43  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  44  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  45  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  46  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  47  * OF THE POSSIBILITY OF SUCH DAMAGE.
  48  * ====================================================================
  49  *
  50  * This product includes cryptographic software written by Eric Young
  51  * (eay@cryptsoft.com).  This product includes software written by Tim
  52  * Hudson (tjh@cryptsoft.com).
  53  *
  54  */
  55
  56 #include "bn_lcl.h"
  57 #include "cryptlib.h"
  58
  59 #define BN_NIST_192_TOP (192+BN_BITS2-1)/BN_BITS2
  60 #define BN_NIST_224_TOP (224+BN_BITS2-1)/BN_BITS2
  61 #define BN_NIST_256_TOP (256+BN_BITS2-1)/BN_BITS2
  62 #define BN_NIST_384_TOP (384+BN_BITS2-1)/BN_BITS2
  63 #define BN_NIST_521_TOP (521+BN_BITS2-1)/BN_BITS2
  64
  65 #if BN_BITS2 == 64
  66 const static BN_ULONG _nist_p_192[] = {0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFE,
  67         0xFFFFFFFFFFFFFFFF};
  68 const static BN_ULONG _nist_p_224[] = {0x0000000000000001,0xFFFFFFFF00000000,
  69         0xFFFFFFFFFFFFFFFF,0x00000000FFFFFFFF};
  70 const static BN_ULONG _nist_p_256[] = {0xFFFFFFFFFFFFFFFF,0x00000000FFFFFFFF,
  71         0x0000000000000000,0xFFFFFFFF00000001};
  72 const static BN_ULONG _nist_p_384[] = {0x00000000FFFFFFFF,0xFFFFFFFF00000000,
  73         0xFFFFFFFFFFFFFFFE,0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  74         0xFFFFFFFFFFFFFFFF};
  75 const static BN_ULONG _nist_p_521[] = {0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  76         0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  77         0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,0xFFFFFFFFFFFFFFFF,
  78         0x00000000000001FF};
  79 #elif BN_BITS2 == 32
  80 const static BN_ULONG _nist_p_192[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFE,
  81         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
  82 const static BN_ULONG _nist_p_224[] = {0x00000001,0x00000000,0x00000000,
  83         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
  84 const static BN_ULONG _nist_p_256[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  85         0x00000000,0x00000000,0x00000000,0x00000001,0xFFFFFFFF};
  86 const static BN_ULONG _nist_p_384[] = {0xFFFFFFFF,0x00000000,0x00000000,
  87         0xFFFFFFFF,0xFFFFFFFE,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  88         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
  89 const static BN_ULONG _nist_p_521[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  90         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  91         0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
  92         0xFFFFFFFF,0x000001FF};
  93 #elif BN_BITS2 == 16
  94 const static BN_ULONG _nist_p_192[] = {0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFE,
  95         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF};
  96 const static BN_ULONG _nist_p_224[] = {0x0001,0x0000,0x0000,0x0000,0x0000,
  97         0x0000,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF};
  98 const static BN_ULONG _nist_p_256[] = {0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
  99         0xFFFF,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0001,0x0000,0xFFFF,
 100         0xFFFF};
 101 const static BN_ULONG _nist_p_384[] = {0xFFFF,0xFFFF,0x0000,0x0000,0x0000,
 102         0x0000,0xFFFF,0xFFFF,0xFFFE,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 103         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF};
 104 const static BN_ULONG _nist_p_521[] = {0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 105         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 106         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,
 107         0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0xFFFF,0x01FF};
 108 #elif BN_BITS2 == 8
 109 const static BN_ULONG _nist_p_192[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 110         0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 111         0xFF,0xFF};
 112 const static BN_ULONG _nist_p_224[] = {0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 113         0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 114         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 115 const static BN_ULONG _nist_p_256[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 116         0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 117         0x00,0x00,0x01,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF};
 118 const static BN_ULONG _nist_p_384[] = {0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,
 119         0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,
 120         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 121         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 122 const static BN_ULONG _nist_p_521[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 123         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 124         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 125         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 126         0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
 127         0xFF,0x01};
 128 #endif
 129
 130 const BIGNUM *BN_get0_nist_prime_192(void)
 131         {
 132         static BIGNUM const_nist_192 = { (BN_ULONG *)_nist_p_192,
 133                 BN_NIST_192_TOP, BN_NIST_192_TOP, 0, BN_FLG_STATIC_DATA };
 134         return &const_nist_192;
 135         }
 136
 137 const BIGNUM *BN_get0_nist_prime_224(void)
 138         {
 139         static BIGNUM const_nist_224 = { (BN_ULONG *)_nist_p_224,
 140                 BN_NIST_224_TOP, BN_NIST_224_TOP, 0, BN_FLG_STATIC_DATA };
 141         return &const_nist_224;
 142         }
 143
 144 const BIGNUM *BN_get0_nist_prime_256(void)
 145         {
 146         static BIGNUM const_nist_256 = { (BN_ULONG *)_nist_p_256,
 147                 BN_NIST_256_TOP, BN_NIST_256_TOP, 0, BN_FLG_STATIC_DATA };
 148         return &const_nist_256;
 149         }
 150
 151 const BIGNUM *BN_get0_nist_prime_384(void)
 152         {
 153         static BIGNUM const_nist_384 = { (BN_ULONG *)_nist_p_384,
 154                 BN_NIST_384_TOP, BN_NIST_384_TOP, 0, BN_FLG_STATIC_DATA };
 155         return &const_nist_384;
 156         }
 157
 158 const BIGNUM *BN_get0_nist_prime_521(void)
 159         {
 160         static BIGNUM const_nist_521 = { (BN_ULONG *)_nist_p_521,
 161                 BN_NIST_521_TOP, BN_NIST_521_TOP, 0, BN_FLG_STATIC_DATA };
 162         return &const_nist_521;
 163         }
 164
 165 /* some misc internal functions */
 166 static BN_ULONG _256_data[BN_NIST_256_TOP*6];
 167 static int _is_set_256_data = 0;
 168 static void _init_256_data(void);
 169
 170 static BN_ULONG _384_data[BN_NIST_384_TOP*8];
 171 static int _is_set_384_data = 0;
 172 static void _init_384_data(void);
 173
 174 #define BN_NIST_ADD_ONE(a)      while (!(++(*(a)))) ++(a);
 175 #define __buf_0                 (BN_ULONG)0
 176 #define __buf_0_1               (BN_ULONG)0
 177 #define __buf_0_2               (BN_ULONG)0
 178 #if BN_BITS2 == 64
 179 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n = (BN_ULONG)0;
 180 #define BN_CP_64_TO_BUF(n)      __buf_##n = (a)[(n)];
 181 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n;
 182 #define BN_CASE_64_BIT(n,a)     case (n): __buf_##n = (a)[(n)];
 183 #if     UINT_MAX == 4294967295UL
 184 #define nist32  unsigned int
 185 #define BN_32_BIT_BUF(n)        nist32 __buf_##n = (nist32)0;
 186 #define BN_CP_32_TO_BUF(n)      __buf_##n = ((nist32 *)(a))[(n)];
 187 #define BN_CP_32_FROM_BUF(a,n)  *((nist32)(a))++ = __buf_##n;
 188 #define BN_CASE_32_BIT(n,a)     case (n): __buf_##n = ((nist32)(a))[(n)];
 189 #elif   ULONG_MAX == 4294967295UL
 190 #define nist32  unsigned long
 191 #define BN_32_BIT_BUF(n)        nist32 __buf_##n = (nist32)0;
 192 #define BN_CP_32_TO_BUF(n)      __buf_##n = ((nist32 *)(a))[(n)];
 193 #define BN_CP_32_FROM_BUF(a,n)  *((nist32)(a))++ = __buf_##n;
 194 #define BN_CASE_32_BIT(n,a)     case (n): __buf_##n = ((nist32)(a))[(n)];
 195 #else
 196 #define NO_32_BIT_TYPE
 197 #endif
 198 #elif BN_BITS2 == 32
 199 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 200                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;
 201 #define BN_CP_64_TO_BUF(n)      __buf_##n##_2 = (a)[2*(n)+1];\
 202                                 __buf_##n##_1 = (a)[2*(n)];
 203 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 204                                 *(a)++ = __buf_##n##_2;
 205 #define BN_CASE_64_BIT(n,a)     case 2*(n)+1: __buf_##n##_2 = (a)[2*(n)+1];\
 206                                 case 2*(n):   __buf_##n##_1 = (a)[2*(n)];
 207
 208 #define BN_32_BIT_BUF(n)        BN_ULONG __buf_##n = (BN_ULONG)0;
 209 #define BN_CP_32_TO_BUF(n)      __buf_##n = (a)[(n)];
 210 #define BN_CP_32_FROM_BUF(a,n)  *(a)++ = __buf_##n;
 211 #define BN_CASE_32_BIT(n,a)     case (n): __buf_##n = (a)[(n)];
 212 #elif BN_BITS2 == 16
 213 #define __buf_0_3               (BN_ULONG)0
 214 #define __buf_0_4               (BN_ULONG)0
 215 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 216                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;\
 217                                 BN_ULONG __buf_##n##_3 = (BN_ULONG)0;\
 218                                 BN_ULONG __buf_##n##_4 = (BN_ULONG)0;
 219 #define BN_CP_64_TO_BUF(n)      __buf_##n##_4 = (a)[4*(n)+3];\
 220                                 __buf_##n##_3 = (a)[4*(n)+2];\
 221                                 __buf_##n##_2 = (a)[4*(n)+1];\
 222                                 __buf_##n##_1 = (a)[4*(n)];
 223 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 224                                 *(a)++ = __buf_##n##_2;\
 225                                 *(a)++ = __buf_##n##_3;\
 226                                 *(a)++ = __buf_##n##_4;
 227 #define BN_CASE_64_BIT(n,a)     case 4*(n)+3: __buf_##n##_4 = (a)[4*(n)+3];\
 228                                 case 4*(n)+2: __buf_##n##_3 = (a)[4*(n)+2];\
 229                                 case 4*(n)+1: __buf_##n##_2 = (a)[4*(n)+1];\
 230                                 case 4*(n):   __buf_##n##_1 = (a)[4*(n)];
 231 #define BN_32_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 232                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;
 233 #define BN_CP_32_TO_BUF(n)      __buf_##n##_1 = (a)[2*(n)];\
 234                                 __buf_##n##_2 = (a)[2*(n)+1];
 235 #define BN_CP_32_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 236                                 *(a)++ = __buf_##n##_2;
 237 #define BN_CASE_32_BIT(n,a)     case 2*(n)+1: __buf_##n##_2 = (a)[2*(n)+1];\
 238                                 case 2*(n):   __buf_##n##_1 = (a)[2*(n)];
 239 #elif BN_BITS2 == 8
 240 #define __buf_0_3               (BN_ULONG)0
 241 #define __buf_0_4               (BN_ULONG)0
 242 #define __buf_0_5               (BN_ULONG)0
 243 #define __buf_0_6               (BN_ULONG)0
 244 #define __buf_0_7               (BN_ULONG)0
 245 #define __buf_0_8               (BN_ULONG)0
 246 #define BN_64_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 247                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;\
 248                                 BN_ULONG __buf_##n##_3 = (BN_ULONG)0;\
 249                                 BN_ULONG __buf_##n##_4 = (BN_ULONG)0;\
 250                                 BN_ULONG __buf_##n##_5 = (BN_ULONG)0;\
 251                                 BN_ULONG __buf_##n##_6 = (BN_ULONG)0;\
 252                                 BN_ULONG __buf_##n##_7 = (BN_ULONG)0;\
 253                                 BN_ULONG __buf_##n##_8 = (BN_ULONG)0;
 254 #define BN_CP_64_TO_BUF(n)      __buf_##n##_8 = (a)[8*(n)+7];\
 255                                 __buf_##n##_7 = (a)[8*(n)+6];\
 256                                 __buf_##n##_6 = (a)[8*(n)+5];\
 257                                 __buf_##n##_5 = (a)[8*(n)+4];\
 258                                 __buf_##n##_4 = (a)[8*(n)+3];\
 259                                 __buf_##n##_3 = (a)[8*(n)+2];\
 260                                 __buf_##n##_2 = (a)[8*(n)+1];\
 261                                 __buf_##n##_1 = (a)[8*(n)];
 262 #define BN_CP_64_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 263                                 *(a)++ = __buf_##n##_2;\
 264                                 *(a)++ = __buf_##n##_3;\
 265                                 *(a)++ = __buf_##n##_4;\
 266                                 *(a)++ = __buf_##n##_5;\
 267                                 *(a)++ = __buf_##n##_6;\
 268                                 *(a)++ = __buf_##n##_7;\
 269                                 *(a)++ = __buf_##n##_8;
 270 #define BN_CASE_64_BIT(n,a)     case 8*(n)+7: __buf_##n##_8 = (a)[8*(n)+7];\
 271                                 case 8*(n)+6: __buf_##n##_7 = (a)[8*(n)+6];\
 272                                 case 8*(n)+5: __buf_##n##_6 = (a)[8*(n)+5];\
 273                                 case 8*(n)+4: __buf_##n##_5 = (a)[8*(n)+4];\
 274                                 case 8*(n)+3: __buf_##n##_4 = (a)[8*(n)+3];\
 275                                 case 8*(n)+2: __buf_##n##_3 = (a)[8*(n)+2];\
 276                                 case 8*(n)+1: __buf_##n##_2 = (a)[8*(n)+1];\
 277                                 case 8*(n):   __buf_##n##_1 = (a)[8*(n)];
 278 #define BN_32_BIT_BUF(n)        BN_ULONG __buf_##n##_1 = (BN_ULONG)0;\
 279                                 BN_ULONG __buf_##n##_2 = (BN_ULONG)0;\
 280                                 BN_ULONG __buf_##n##_3 = (BN_ULONG)0;\
 281                                 BN_ULONG __buf_##n##_4 = (BN_ULONG)0;
 282 #define BN_CP_32_TO_BUF(n)      __buf_##n##_1 = (a)[4*(n)];\
 283                                 __buf_##n##_2 = (a)[4*(n)+1];\
 284                                 __buf_##n##_3 = (a)[4*(n)+2];\
 285                                 __buf_##n##_4 = (a)[4*(n)+3];
 286 #define BN_CP_32_FROM_BUF(a,n)  *(a)++ = __buf_##n##_1;\
 287                                 *(a)++ = __buf_##n##_2;\
 288                                 *(a)++ = __buf_##n##_3;\
 289                                 *(a)++ = __buf_##n##_4;
 290 #define BN_CASE_32_BIT(n,a)     case 4*(n)+3: __buf_##n##_4 = (a)[4*(n)+3];\
 291                                 case 4*(n)+2: __buf_##n##_3 = (a)[4*(n)+2];\
 292                                 case 4*(n)+1: __buf_##n##_2 = (a)[4*(n)+1];\
 293                                 case 4*(n):   __buf_##n##_1 = (a)[4*(n)];
 294 #endif
 295
 296
 297 #define BN_192_SET(d,a1,a2,a3) \
 298         {\
 299         register BN_ULONG *td = (d);\
 300         BN_CP_64_FROM_BUF(td,a3); BN_CP_64_FROM_BUF(td,a2);\
 301         BN_CP_64_FROM_BUF(td,a1);\
 302         }
 303
 304 int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 305         BN_CTX *ctx)
 306         {
 307         int      top;
 308         BN_ULONG carry = 0;
 309         register BN_ULONG *r_d, *a_d;
 310         BN_ULONG t_d[BN_NIST_192_TOP];
 311         BN_64_BIT_BUF(3)  BN_64_BIT_BUF(4)
 312         BN_64_BIT_BUF(5)
 313
 314         top = BN_ucmp(field, a);
 315         if (top == 0)
 316                 return BN_zero(r);
 317         else if (top > 0)
 318                 return (r == a)? 1 : (BN_copy(r ,a) != NULL);
 319
 320         if (r != a)
 321                 if (!BN_ncopy(r, a, BN_NIST_192_TOP))
 322                         return 0;
 323
 324         r_d = r->d;
 325         a_d = a->d;
 326         top = a->top-1;
 327
 328         switch (top)
 329                 {
 330                 BN_CASE_64_BIT(5, a_d)
 331                 BN_CASE_64_BIT(4, a_d)
 332                 BN_CASE_64_BIT(3, a_d)
 333                         break;
 334                 default: /* a->top == field->top */
 335                         return BN_usub(r, a, field);
 336                 }
 337
 338         BN_192_SET(t_d,0,3,3)
 339         if (bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP))
 340                 ++carry;
 341
 342         BN_192_SET(t_d,4,4,0)
 343         if (bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP))
 344                 ++carry;
 345
 346         BN_192_SET(t_d,5,5,5)
 347         if (bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP))
 348                 ++carry;
 349
 350         while (carry)
 351                 {
 352                 if (bn_sub_words(r_d, r_d, _nist_p_192, BN_NIST_192_TOP))
 353                         --carry;
 354                 }
 355         r->top = BN_NIST_192_TOP;
 356
 357 #if 1
 358         bn_clear_top2max(r);
 359 #endif
 360         bn_correct_top(r);
 361
 362         if (BN_ucmp(r, field) >= 0)
 363                 {
 364                 bn_sub_words(r_d, r_d, _nist_p_192, BN_NIST_192_TOP);
 365                 bn_correct_top(r);
 366                 }
 367
 368         bn_check_top(r);
 369         return 1;
 370         }
 371
 372 #define BN_224_SET(d,a1,a2,a3,a4,a5,a6,a7) \
 373         {\
 374         register BN_ULONG *td = (d);\
 375         BN_CP_32_FROM_BUF(td,a7); BN_CP_32_FROM_BUF(td,a6);\
 376         BN_CP_32_FROM_BUF(td,a5); BN_CP_32_FROM_BUF(td,a4);\
 377         BN_CP_32_FROM_BUF(td,a3); BN_CP_32_FROM_BUF(td,a2);\
 378         BN_CP_32_FROM_BUF(td,a1);\
 379         }
 380
 381 int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 382         BN_CTX *ctx)
 383         {
 384 #ifndef NO_32_BIT_TYPE
 385         int     tmp_int;
 386         int     carry = 0;
 387         BN_ULONG *r_d, *a_d;
 388         BN_ULONG t_d[BN_NIST_224_TOP];
 389         BN_32_BIT_BUF(7)  BN_32_BIT_BUF(8)
 390         BN_32_BIT_BUF(9)  BN_32_BIT_BUF(10)
 391         BN_32_BIT_BUF(11) BN_32_BIT_BUF(12)
 392         BN_32_BIT_BUF(13)
 393
 394         tmp_int = BN_ucmp(field, a);
 395         if (tmp_int == 0)
 396                 return BN_zero(r);
 397         else if (tmp_int > 0)
 398                 return (r == a)? 1 : (BN_copy(r ,a) != NULL);
 399
 400         if (r != a)
 401                 if (!BN_ncopy(r, a, BN_NIST_224_TOP))
 402                         return 0;
 403
 404         r_d = r->d;
 405         a_d = a->d;
 406
 407         tmp_int = a->top-1;
 408
 409         switch (tmp_int)
 410                 {
 411                 BN_CASE_32_BIT(13, a_d)
 412                 BN_CASE_32_BIT(12, a_d)
 413                 BN_CASE_32_BIT(11, a_d)
 414                 BN_CASE_32_BIT(10, a_d)
 415                 BN_CASE_32_BIT(9,  a_d)
 416                 BN_CASE_32_BIT(8,  a_d)
 417                 BN_CASE_32_BIT(7,  a_d)
 418                         break;
 419                 default: /* a->top == field->top */
 420                         return BN_usub(r, a, field);
 421                 }
 422
 423         BN_224_SET(t_d,10,9,8,7,0,0,0)
 424         if (bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 425                 ++carry;
 426         BN_224_SET(t_d,0,13,12,11,0,0,0)
 427         if (bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 428                 ++carry;
 429         BN_224_SET(t_d,13,12,11,10,9,8,7)
 430         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 431                 --carry;
 432         BN_224_SET(t_d,0,0,0,0,13,12,11)
 433         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP))
 434                 --carry;
 435
 436         if (carry > 0)
 437                 while (carry)
 438                         {
 439                         if (bn_sub_words(r_d,r_d,_nist_p_224,BN_NIST_224_TOP))
 440                                 --carry;
 441                         }
 442         else if (carry < 0)
 443                 while (carry)
 444                         {
 445                         if (bn_add_words(r_d,r_d,_nist_p_224,BN_NIST_224_TOP))
 446                                 ++carry;
 447                         }
 448
 449         r->top = BN_NIST_224_TOP;
 450 #if 1
 451         bn_clear_top2max(r);
 452 #endif
 453         bn_correct_top(r);
 454
 455         if (BN_ucmp(r, field) >= 0)
 456                 {
 457                 bn_sub_words(r_d, r_d, _nist_p_224, BN_NIST_224_TOP);
 458                 bn_correct_top(r);
 459                 }
 460         bn_check_top(r);
 461         return 1;
 462 #else
 463         return 0;
 464 #endif
 465         }
 466
 467 static void _init_256_data(void)
 468         {
 469         int     i;
 470         BN_ULONG *tmp1 = _256_data;
 471         const BN_ULONG *tmp2 = tmp1;
 472
 473         memcpy(tmp1, _nist_p_256, BN_NIST_256_TOP * sizeof(BN_ULONG));
 474         tmp1 += BN_NIST_256_TOP;
 475
 476         for (i=0; i<5; i++)
 477                 {
 478                 bn_add_words(tmp1, _nist_p_256, tmp2, BN_NIST_256_TOP);
 479                 tmp2  = tmp1;
 480                 tmp1 += BN_NIST_256_TOP;
 481                 }
 482         _is_set_256_data = 1;
 483         }
 484
 485 #define BN_256_SET(d,a1,a2,a3,a4,a5,a6,a7,a8) \
 486         {\
 487         register BN_ULONG *td = (d);\
 488         BN_CP_32_FROM_BUF(td,a8); BN_CP_32_FROM_BUF(td,a7);\
 489         BN_CP_32_FROM_BUF(td,a6); BN_CP_32_FROM_BUF(td,a5);\
 490         BN_CP_32_FROM_BUF(td,a4); BN_CP_32_FROM_BUF(td,a3);\
 491         BN_CP_32_FROM_BUF(td,a2); BN_CP_32_FROM_BUF(td,a1);\
 492         }
 493
 494 int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 495         BN_CTX *ctx)
 496         {
 497 #ifndef NO_32_BIT_TYPE
 498         int     tmp_int;
 499         int     carry = 0;
 500         register BN_ULONG *a_d, *r_d;
 501         BN_ULONG t_d[BN_NIST_256_TOP];
 502         BN_ULONG t_d2[BN_NIST_256_TOP];
 503         BN_32_BIT_BUF(8)  BN_32_BIT_BUF(9)
 504         BN_32_BIT_BUF(10) BN_32_BIT_BUF(11)
 505         BN_32_BIT_BUF(12) BN_32_BIT_BUF(13)
 506         BN_32_BIT_BUF(14) BN_32_BIT_BUF(15)
 507
 508         if (!_is_set_256_data)
 509                 {
 510                 CRYPTO_w_lock(CRYPTO_LOCK_BN);
 511
 512                 if (!_is_set_256_data)
 513                         _init_256_data();
 514
 515                 CRYPTO_w_unlock(CRYPTO_LOCK_BN);
 516                 }
 517
 518         tmp_int = BN_ucmp(field, a);
 519         if (tmp_int == 0)
 520                 return BN_zero(r);
 521         else if (tmp_int > 0)
 522                 return (r == a)? 1 : (BN_copy(r ,a) != NULL);
 523
 524         if (r != a)
 525                 if (!BN_ncopy(r, a, BN_NIST_256_TOP))
 526                         return 0;
 527
 528         tmp_int = a->top-1;
 529
 530         a_d = a->d;
 531         r_d = r->d;
 532         switch (tmp_int)
 533                 {
 534                 BN_CASE_32_BIT(15, a_d)
 535                 BN_CASE_32_BIT(14, a_d)
 536                 BN_CASE_32_BIT(13, a_d)
 537                 BN_CASE_32_BIT(12, a_d)
 538                 BN_CASE_32_BIT(11, a_d)
 539                 BN_CASE_32_BIT(10, a_d)
 540                 BN_CASE_32_BIT(9,  a_d)
 541                 BN_CASE_32_BIT(8,  a_d)
 542                         break;
 543                 default: /* a->top == field->top */
 544                         return BN_usub(r, a, field);
 545                 }
 546
 547         /*S1*/
 548         BN_256_SET(t_d,15,14,13,12,11,0,0,0)
 549         /*S2*/
 550         BN_256_SET(t_d2,0,15,14,13,12,0,0,0)
 551         if (bn_add_words(t_d, t_d, t_d2, BN_NIST_256_TOP))
 552                 carry = 2;
 553         /* left shift */
 554                 {
 555                 register BN_ULONG *ap,t,c;
 556                 ap = t_d;
 557                 c=0;
 558                 for (tmp_int=BN_NIST_256_TOP; tmp_int != 0; --tmp_int)
 559                         {
 560                         t= *ap;
 561                         *(ap++)=((t<<1)|c)&BN_MASK2;
 562                         c=(t & BN_TBIT)?1:0;
 563                         }
 564                 if (c)
 565                         ++carry;
 566                 }
 567
 568         if (bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 569                 ++carry;
 570         /*S3*/
 571         BN_256_SET(t_d,15,14,0,0,0,10,9,8)
 572         if (bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 573                 ++carry;
 574         /*S4*/
 575         BN_256_SET(t_d,8,13,15,14,13,11,10,9)
 576         if (bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 577                 ++carry;
 578         /*D1*/
 579         BN_256_SET(t_d,10,8,0,0,0,13,12,11)
 580         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 581                 --carry;
 582         /*D2*/
 583         BN_256_SET(t_d,11,9,0,0,15,14,13,12)
 584         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 585                 --carry;
 586         /*D3*/
 587         BN_256_SET(t_d,12,0,10,9,8,15,14,13)
 588         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 589                 --carry;
 590         /*D4*/
 591         BN_256_SET(t_d,13,0,11,10,9,0,15,14)
 592         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
 593                 --carry;
 594
 595         if (carry)
 596                 {
 597                 if (carry > 0)
 598                         bn_sub_words(r_d, r_d, _256_data + BN_NIST_256_TOP *
 599                                 --carry, BN_NIST_256_TOP);
 600                 else
 601                         {
 602                         carry = -carry;
 603                         bn_add_words(r_d, r_d, _256_data + BN_NIST_256_TOP *
 604                                 --carry, BN_NIST_256_TOP);
 605                         }
 606                 }
 607
 608         r->top = BN_NIST_256_TOP;
 609 #if 1
 610         bn_clear_top2max(r);
 611 #endif
 612         bn_correct_top(r);
 613
 614         if (BN_ucmp(r, field) >= 0)
 615                 {
 616                 bn_sub_words(r_d, r_d, _nist_p_256, BN_NIST_256_TOP);
 617                 bn_correct_top(r);
 618                 }
 619         bn_check_top(r);
 620         return 1;
 621 #else
 622         return 0;
 623 #endif
 624         }
 625
 626 static void _init_384_data(void)
 627         {
 628         int     i;
 629         BN_ULONG *tmp1 = _384_data;
 630         const BN_ULONG *tmp2 = tmp1;
 631
 632         memcpy(tmp1, _nist_p_384, BN_NIST_384_TOP * sizeof(BN_ULONG));
 633         tmp1 += BN_NIST_384_TOP;
 634
 635         for (i=0; i<7; i++)
 636                 {
 637                 bn_add_words(tmp1, _nist_p_384, tmp2, BN_NIST_384_TOP);
 638                 tmp2  = tmp1;
 639                 tmp1 += BN_NIST_384_TOP;
 640                 }
 641         _is_set_384_data = 1;
 642         }
 643
 644 #define BN_384_SET(d,a1,a2,a3,a4,a5,a6,a7,a8,a9,a10,a11,a12) \
 645         {\
 646         register BN_ULONG *td = (d);\
 647         BN_CP_32_FROM_BUF(td,a12); BN_CP_32_FROM_BUF(td,a11);\
 648         BN_CP_32_FROM_BUF(td,a10); BN_CP_32_FROM_BUF(td,a9);\
 649         BN_CP_32_FROM_BUF(td,a8);  BN_CP_32_FROM_BUF(td,a7);\
 650         BN_CP_32_FROM_BUF(td,a6);  BN_CP_32_FROM_BUF(td,a5);\
 651         BN_CP_32_FROM_BUF(td,a4);  BN_CP_32_FROM_BUF(td,a3);\
 652         BN_CP_32_FROM_BUF(td,a2);  BN_CP_32_FROM_BUF(td,a1);\
 653         }
 654
 655 int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 656         BN_CTX *ctx)
 657         {
 658 #ifndef NO_32_BIT_TYPE
 659         int     tmp_int;
 660         int     carry = 0;
 661         register BN_ULONG *r_d, *a_d;
 662         BN_ULONG t_d[BN_NIST_384_TOP];
 663         BN_32_BIT_BUF(12) BN_32_BIT_BUF(13)
 664         BN_32_BIT_BUF(14) BN_32_BIT_BUF(15)
 665         BN_32_BIT_BUF(16) BN_32_BIT_BUF(17)
 666         BN_32_BIT_BUF(18) BN_32_BIT_BUF(19)
 667         BN_32_BIT_BUF(20) BN_32_BIT_BUF(21)
 668         BN_32_BIT_BUF(22) BN_32_BIT_BUF(23)
 669
 670         if (!_is_set_384_data)
 671                 {
 672                 CRYPTO_w_lock(CRYPTO_LOCK_BN);
 673
 674                 if (!_is_set_384_data)
 675                         _init_384_data();
 676
 677                 CRYPTO_w_unlock(CRYPTO_LOCK_BN);
 678                 }
 679
 680         tmp_int = BN_ucmp(field, a);
 681         if (tmp_int == 0)
 682                 return BN_zero(r);
 683         else if (tmp_int > 0)
 684                 return (r == a)? 1 : (BN_copy(r ,a) != NULL);
 685
 686         if (r != a)
 687                 if (!BN_ncopy(r, a, BN_NIST_384_TOP))
 688                         return 0;
 689
 690         r_d = r->d;
 691         a_d = a->d;
 692         tmp_int = a->top-1;
 693
 694         switch (tmp_int)
 695                 {
 696                 BN_CASE_32_BIT(23, a_d)
 697                 BN_CASE_32_BIT(22, a_d)
 698                 BN_CASE_32_BIT(21, a_d)
 699                 BN_CASE_32_BIT(20, a_d)
 700                 BN_CASE_32_BIT(19, a_d)
 701                 BN_CASE_32_BIT(18, a_d)
 702                 BN_CASE_32_BIT(17, a_d)
 703                 BN_CASE_32_BIT(16, a_d)
 704                 BN_CASE_32_BIT(15, a_d)
 705                 BN_CASE_32_BIT(14, a_d)
 706                 BN_CASE_32_BIT(13, a_d)
 707                 BN_CASE_32_BIT(12, a_d)
 708                         break;
 709                 default: /* a->top == field->top */
 710                         return BN_usub(r, a, field);
 711                 }
 712
 713         /*S1*/
 714         BN_256_SET(t_d,0,0,0,0,0,23,22,21)
 715                 /* left shift */
 716                 {
 717                 register BN_ULONG *ap,t,c;
 718                 ap = t_d;
 719                 c=0;
 720                 for (tmp_int=BN_NIST_256_TOP; tmp_int != 0; --tmp_int)
 721                         {
 722                         t= *ap;
 723                         *(ap++)=((t<<1)|c)&BN_MASK2;
 724                         c=(t & BN_TBIT)?1:0;
 725                         }
 726                 }
 727         if (bn_add_words(r_d+(128/BN_BITS2), r_d+(128/BN_BITS2),
 728                 t_d, BN_NIST_256_TOP))
 729                 ++carry;
 730         /*S2*/
 731         BN_384_SET(t_d,23,22,21,20,19,18,17,16,15,14,13,12)
 732         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 733                 ++carry;
 734         /*S3*/
 735         BN_384_SET(t_d,20,19,18,17,16,15,14,13,12,23,22,21)
 736         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 737                 ++carry;
 738         /*S4*/
 739         BN_384_SET(t_d,19,18,17,16,15,14,13,12,20,0,23,0)
 740         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 741                 ++carry;
 742         /*S5*/
 743         BN_256_SET(t_d,0,0,0,0,23,22,21,20)
 744         if (bn_add_words(r_d+(128/BN_BITS2), r_d+(128/BN_BITS2),
 745                 t_d, BN_NIST_256_TOP))
 746                 ++carry;
 747         /*S6*/
 748         BN_384_SET(t_d,0,0,0,0,0,0,23,22,21,0,0,20)
 749         if (bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 750                 ++carry;
 751         /*D1*/
 752         BN_384_SET(t_d,22,21,20,19,18,17,16,15,14,13,12,23)
 753         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 754                 --carry;
 755         /*D2*/
 756         BN_384_SET(t_d,0,0,0,0,0,0,0,23,22,21,20,0)
 757         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 758                 --carry;
 759         /*D3*/
 760         BN_384_SET(t_d,0,0,0,0,0,0,0,23,23,0,0,0)
 761         if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
 762                 --carry;
 763
 764         if (carry)
 765                 {
 766                 if (carry > 0)
 767                         bn_sub_words(r_d, r_d, _384_data + BN_NIST_384_TOP *
 768                                 --carry, BN_NIST_384_TOP);
 769                 else
 770                         {
 771                         carry = -carry;
 772                         bn_add_words(r_d, r_d, _384_data + BN_NIST_384_TOP *
 773                                 --carry, BN_NIST_384_TOP);
 774                         }
 775                 }
 776
 777         r->top = BN_NIST_384_TOP;
 778 #if 1
 779         bn_clear_top2max(r);
 780 #endif
 781         bn_correct_top(r);
 782
 783         if (BN_ucmp(r, field) >= 0)
 784                 {
 785                 bn_sub_words(r_d, r_d, _nist_p_384, BN_NIST_384_TOP);
 786                 bn_correct_top(r);
 787                 }
 788         bn_check_top(r);
 789         return 1;
 790 #else
 791         return 0;
 792 #endif
 793         }
 794
 795 int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 796         BN_CTX *ctx)
 797         {
 798 #if BN_BITS2 == 64
 799 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
 800 #elif BN_BITS2 == 32
 801 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
 802 #elif BN_BITS2 == 16
 803 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
 804 #elif BN_BITS2 == 8
 805 #define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1
 806 #endif
 807         int     top, ret = 0;
 808         BN_ULONG *r_d;
 809         BIGNUM  *tmp;
 810
 811         /* check whether a reduction is necessary */
 812         top = a->top;
 813         if (top < BN_NIST_521_TOP  || ( top == BN_NIST_521_TOP &&
 814            (!(a->d[BN_NIST_521_TOP-1] & ~(BN_NIST_521_TOP_MASK)))))
 815                 return (r == a)? 1 : (BN_copy(r ,a) != NULL);
 816
 817         BN_CTX_start(ctx);
 818         tmp = BN_CTX_get(ctx);
 819         if (!tmp)
 820                 goto err;
 821
 822         if (!BN_ncopy(tmp, a, BN_NIST_521_TOP))
 823                 return 0;
 824         if (!BN_rshift(r, a, 521))
 825                 return 0;
 826
 827         if (tmp->top == BN_NIST_521_TOP)
 828                 tmp->d[BN_NIST_521_TOP-1]  &= BN_NIST_521_TOP_MASK;
 829
 830         bn_correct_top(tmp);
 831         if (!BN_uadd(r, tmp, r))
 832                 return 0;
 833         top = r->top;
 834         r_d = r->d;
 835         if (top == BN_NIST_521_TOP  &&
 836            (r_d[BN_NIST_521_TOP-1] & ~(BN_NIST_521_TOP_MASK)))
 837                 {
 838                 BN_NIST_ADD_ONE(r_d)
 839                 r_d[BN_NIST_521_TOP-1] &= BN_NIST_521_TOP_MASK;
 840                 }
 841         bn_correct_top(r);
 842
 843         ret = 1;
 844 err:
 845         BN_CTX_end(ctx);
 846
 847         bn_check_top(r);
 848         return ret;
 849         }