Missing semicolon.

[openssl.git] / crypto / bn / bn_mont.c

diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c
index a4612d6639e1a1d2e51a3f368548c2e2370b4aec..e6f6e3f0f8720d880231cb94df05035f6c2256a6 100644 (file)
--- a/crypto/bn/bn_mont.c
+++ b/crypto/bn/bn_mont.c
@@ -116,6 +116,8 @@
  * sections 3.8 and 4.2 in http://security.ece.orst.edu/koc/papers/r01rsasw.pdf
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <stdio.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
@@ -177,31 +179,26 @@ err:
 static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
        {
        BIGNUM *n;
-       BN_ULONG *ap,*np,*rp,n0,v,*nrp;
-       int al,nl,max,i,x,ri;
+       BN_ULONG *ap,*np,*rp,n0,v,carry;
+       int nl,max,i;
 
        n= &(mont->N);
-       /* mont->ri is the size of mont->N in bits (rounded up
-          to the word size) */
-       al=ri=mont->ri/BN_BITS2;
-
        nl=n->top;
-       if ((al == 0) || (nl == 0)) { ret->top=0; return(1); }
+       if (nl == 0) { ret->top=0; return(1); }
 
-       max=(nl+al+1); /* allow for overflow (no?) XXX */
+       max=(2*nl); /* carry is stored separately */
        if (bn_wexpand(r,max) == NULL) return(0);
 
        r->neg^=n->neg;
        np=n->d;
        rp=r->d;
-       nrp= &(r->d[nl]);
 
        /* clear the top words of T */
 #if 1
        for (i=r->top; i<max; i++) /* memset? XXX */
-               r->d[i]=0;
+               rp[i]=0;
 #else
-       memset(&(r->d[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
+       memset(&(rp[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
 #endif
 
        r->top=max;
@@ -210,7 +207,7 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
 #ifdef BN_COUNT
        fprintf(stderr,"word BN_from_montgomery_word %d * %d\n",nl,nl);
 #endif
-       for (i=0; i<nl; i++)
+       for (carry=0, i=0; i<nl; i++, rp++)
                {
 #ifdef __TANDEM
                 {
@@ -228,58 +225,54 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
 #else
                v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
 #endif
-               nrp++;
-               rp++;
-               if (((nrp[-1]+=v)&BN_MASK2) >= v)
-                       continue;
-               else
-                       {
-                       if (((++nrp[0])&BN_MASK2) != 0) continue;
-                       if (((++nrp[1])&BN_MASK2) != 0) continue;
-                       for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
-                       }
+               v = (v+carry+rp[nl])&BN_MASK2;
+               carry |= (v != rp[nl]);
+               carry &= (v <= rp[nl]);
+               rp[nl]=v;
                }
-       bn_correct_top(r);
-       
-       /* mont->ri will be a multiple of the word size */
-#if 0
-       BN_rshift(ret,r,mont->ri);
-#else
-       if (r->top < ri)
-               {
-               ret->top=0;
-               return(1);
-               }
-       al=r->top-ri;
-       if (bn_wexpand(ret,al) == NULL) return(0);
+
+       if (bn_wexpand(ret,nl) == NULL) return(0);
+       ret->top=nl;
        ret->neg=r->neg;
-       ret->top=al;
 
        rp=ret->d;
-       ap=&(r->d[ri]);
-       al-=4;
-       for (i=0; i<al; i+=4)
+       ap=&(r->d[nl]);
+
+#define BRANCH_FREE 1
+#if BRANCH_FREE
+       {
+       BN_ULONG *nrp;
+       size_t m;
+
+       v=bn_sub_words(rp,ap,np,nl)-carry;
+       /* if subtraction result is real, then
+        * trick unconditional memcpy below to perform in-place
+        * "refresh" instead of actual copy. */
+       m=(0-(size_t)v);
+       nrp=(BN_ULONG *)(((PTR_SIZE_INT)rp&~m)|((PTR_SIZE_INT)ap&m));
+
+       for (i=0,nl-=4; i<nl; i+=4)
                {
                BN_ULONG t1,t2,t3,t4;
                
-               t1=ap[i+0];
-               t2=ap[i+1];
-               t3=ap[i+2];
-               t4=ap[i+3];
-               rp[i+0]=t1;
-               rp[i+1]=t2;
+               t1=nrp[i+0];
+               t2=nrp[i+1];
+               t3=nrp[i+2];    ap[i+0]=0;
+               t4=nrp[i+3];    ap[i+1]=0;
+               rp[i+0]=t1;     ap[i+2]=0;
+               rp[i+1]=t2;     ap[i+3]=0;
                rp[i+2]=t3;
                rp[i+3]=t4;
                }
-       al+=4;
-       for (; i<al; i++)
-               rp[i]=ap[i];
+       for (nl+=4; i<nl; i++)
+               rp[i]=nrp[i], ap[i]=0;
+       }
+#else
+       if (bn_sub_words (rp,ap,np,nl)-carry)
+               memcpy(rp,ap,nl*sizeof(BN_ULONG));
 #endif
-
-       if (BN_ucmp(ret, &(mont->N)) >= 0)
-               {
-               if (!BN_usub(ret,ret,&(mont->N))) return(0);
-               }
+       bn_correct_top(r);
+       bn_correct_top(ret);
        bn_check_top(ret);
 
        return(1);
@@ -345,6 +338,7 @@ void BN_MONT_CTX_init(BN_MONT_CTX *ctx)
        BN_init(&(ctx->RR));
        BN_init(&(ctx->N));
        BN_init(&(ctx->Ni));
+       ctx->n0[0] = ctx->n0[1] = 0;
        ctx->flags=0;
        }
 
@@ -376,6 +370,7 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
                BIGNUM tmod;
                BN_ULONG buf[2];
 
+               BN_init(&tmod);
                tmod.d=buf;
                tmod.dmax=2;
                tmod.neg=0;
@@ -383,6 +378,11 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
                mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
 
 #if defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32)
+               /* Only certain BN_BITS2<=32 platforms actually make use of
+                * n0[1], and we could use the #else case (with a shorter R
+                * value) for the others.  However, currently only the assembler
+                * files do know which is which. */
+
                BN_zero(R);
                if (!(BN_set_bit(R,2*BN_BITS2))) goto err;