[thirdparty/openssl.git] / crypto / bn / bn_gcd.c

/* crypto/bn/bn_gcd.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 *
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 *
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */
/* ====================================================================
 * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include "internal/cryptlib.h"
#include "bn_lcl.h"

static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);

int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
{
    BIGNUM *a, *b, *t;
    int ret = 0;

    bn_check_top(in_a);
    bn_check_top(in_b);

    BN_CTX_start(ctx);
    a = BN_CTX_get(ctx);
    b = BN_CTX_get(ctx);
    if (a == NULL || b == NULL)
        goto err;

    if (BN_copy(a, in_a) == NULL)
        goto err;
    if (BN_copy(b, in_b) == NULL)
        goto err;
    a->neg = 0;
    b->neg = 0;

    if (BN_cmp(a, b) < 0) {
        t = a;
        a = b;
        b = t;
    }
    t = euclid(a, b);
    if (t == NULL)
        goto err;

    if (BN_copy(r, t) == NULL)
        goto err;
    ret = 1;
 err:
    BN_CTX_end(ctx);
    bn_check_top(r);
    return (ret);
}

static BIGNUM *euclid(BIGNUM *a, BIGNUM *b)
{
    BIGNUM *t;
    int shifts = 0;

    bn_check_top(a);
    bn_check_top(b);

    /* 0 <= b <= a */
    while (!BN_is_zero(b)) {
        /* 0 < b <= a */

        if (BN_is_odd(a)) {
            if (BN_is_odd(b)) {
                if (!BN_sub(a, a, b))
                    goto err;
                if (!BN_rshift1(a, a))
                    goto err;
                if (BN_cmp(a, b) < 0) {
                    t = a;
                    a = b;
                    b = t;
                }
            } else {            /* a odd - b even */

                if (!BN_rshift1(b, b))
                    goto err;
                if (BN_cmp(a, b) < 0) {
                    t = a;
                    a = b;
                    b = t;
                }
            }
        } else {                /* a is even */

            if (BN_is_odd(b)) {
                if (!BN_rshift1(a, a))
                    goto err;
                if (BN_cmp(a, b) < 0) {
                    t = a;
                    a = b;
                    b = t;
                }
            } else {            /* a even - b even */

                if (!BN_rshift1(a, a))
                    goto err;
                if (!BN_rshift1(b, b))
                    goto err;
                shifts++;
            }
        }
        /* 0 <= b <= a */
    }

    if (shifts) {
        if (!BN_lshift(a, a, shifts))
            goto err;
    }
    bn_check_top(a);
    return (a);
 err:
    return (NULL);
}

/* solves ax == 1 (mod n) */
static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
                                        const BIGNUM *a, const BIGNUM *n,
                                        BN_CTX *ctx);

BIGNUM *BN_mod_inverse(BIGNUM *in,
                       const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
{
    BIGNUM *rv;
    int noinv;
    rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
    if (noinv)
        BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);
    return rv;
}

BIGNUM *int_bn_mod_inverse(BIGNUM *in,
                           const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
                           int *pnoinv)
{
    BIGNUM *A, *B, *X, *Y, *M, *D, *T, *R = NULL;
    BIGNUM *ret = NULL;
    int sign;

    if (pnoinv)
        *pnoinv = 0;

    if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
        || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
        return BN_mod_inverse_no_branch(in, a, n, ctx);
    }

    bn_check_top(a);
    bn_check_top(n);

    BN_CTX_start(ctx);
    A = BN_CTX_get(ctx);
    B = BN_CTX_get(ctx);
    X = BN_CTX_get(ctx);
    D = BN_CTX_get(ctx);
    M = BN_CTX_get(ctx);
    Y = BN_CTX_get(ctx);
    T = BN_CTX_get(ctx);
    if (T == NULL)
        goto err;

    if (in == NULL)
        R = BN_new();
    else
        R = in;
    if (R == NULL)
        goto err;

    BN_one(X);
    BN_zero(Y);
    if (BN_copy(B, a) == NULL)
        goto err;
    if (BN_copy(A, n) == NULL)
        goto err;
    A->neg = 0;
    if (B->neg || (BN_ucmp(B, A) >= 0)) {
        if (!BN_nnmod(B, B, A, ctx))
            goto err;
    }
    sign = -1;
    /*-
     * From  B = a mod |n|,  A = |n|  it follows that
     *
     *      0 <= B < A,
     *     -sign*X*a  ==  B   (mod |n|),
     *      sign*Y*a  ==  A   (mod |n|).
     */

    if (BN_is_odd(n) && (BN_num_bits(n) <= (BN_BITS <= 32 ? 450 : 2048))) {
        /*
         * Binary inversion algorithm; requires odd modulus. This is faster
         * than the general algorithm if the modulus is sufficiently small
         * (about 400 .. 500 bits on 32-bit sytems, but much more on 64-bit
         * systems)
         */
        int shift;

        while (!BN_is_zero(B)) {
            /*-
             *      0 < B < |n|,
             *      0 < A <= |n|,
             * (1) -sign*X*a  ==  B   (mod |n|),
             * (2)  sign*Y*a  ==  A   (mod |n|)
             */

            /*
             * Now divide B by the maximum possible power of two in the
             * integers, and divide X by the same value mod |n|. When we're
             * done, (1) still holds.
             */
            shift = 0;
            while (!BN_is_bit_set(B, shift)) { /* note that 0 < B */
                shift++;

                if (BN_is_odd(X)) {
                    if (!BN_uadd(X, X, n))
                        goto err;
                }
                /*
                 * now X is even, so we can easily divide it by two
                 */
                if (!BN_rshift1(X, X))
                    goto err;
            }
            if (shift > 0) {
                if (!BN_rshift(B, B, shift))
                    goto err;
            }

            /*
             * Same for A and Y.  Afterwards, (2) still holds.
             */
            shift = 0;
            while (!BN_is_bit_set(A, shift)) { /* note that 0 < A */
                shift++;

                if (BN_is_odd(Y)) {
                    if (!BN_uadd(Y, Y, n))
                        goto err;
                }
                /* now Y is even */
                if (!BN_rshift1(Y, Y))
                    goto err;
            }
            if (shift > 0) {
                if (!BN_rshift(A, A, shift))
                    goto err;
            }

            /*-
             * We still have (1) and (2).
             * Both  A  and  B  are odd.
             * The following computations ensure that
             *
             *     0 <= B < |n|,
             *      0 < A < |n|,
             * (1) -sign*X*a  ==  B   (mod |n|),
             * (2)  sign*Y*a  ==  A   (mod |n|),
             *
             * and that either  A  or  B  is even in the next iteration.
             */
            if (BN_ucmp(B, A) >= 0) {
                /* -sign*(X + Y)*a == B - A  (mod |n|) */
                if (!BN_uadd(X, X, Y))
                    goto err;
                /*
                 * NB: we could use BN_mod_add_quick(X, X, Y, n), but that
                 * actually makes the algorithm slower
                 */
                if (!BN_usub(B, B, A))
                    goto err;
            } else {
                /*  sign*(X + Y)*a == A - B  (mod |n|) */
                if (!BN_uadd(Y, Y, X))
                    goto err;
                /*
                 * as above, BN_mod_add_quick(Y, Y, X, n) would slow things
                 * down
                 */
                if (!BN_usub(A, A, B))
                    goto err;
            }
        }
    } else {
        /* general inversion algorithm */

        while (!BN_is_zero(B)) {
            BIGNUM *tmp;

            /*-
             *      0 < B < A,
             * (*) -sign*X*a  ==  B   (mod |n|),
             *      sign*Y*a  ==  A   (mod |n|)
             */

            /* (D, M) := (A/B, A%B) ... */
            if (BN_num_bits(A) == BN_num_bits(B)) {
                if (!BN_one(D))
                    goto err;
                if (!BN_sub(M, A, B))
                    goto err;
            } else if (BN_num_bits(A) == BN_num_bits(B) + 1) {
                /* A/B is 1, 2, or 3 */
                if (!BN_lshift1(T, B))
                    goto err;
                if (BN_ucmp(A, T) < 0) {
                    /* A < 2*B, so D=1 */
                    if (!BN_one(D))
                        goto err;
                    if (!BN_sub(M, A, B))
                        goto err;
                } else {
                    /* A >= 2*B, so D=2 or D=3 */
                    if (!BN_sub(M, A, T))
                        goto err;
                    if (!BN_add(D, T, B))
                        goto err; /* use D (:= 3*B) as temp */
                    if (BN_ucmp(A, D) < 0) {
                        /* A < 3*B, so D=2 */
                        if (!BN_set_word(D, 2))
                            goto err;
                        /*
                         * M (= A - 2*B) already has the correct value
                         */
                    } else {
                        /* only D=3 remains */
                        if (!BN_set_word(D, 3))
                            goto err;
                        /*
                         * currently M = A - 2*B, but we need M = A - 3*B
                         */
                        if (!BN_sub(M, M, B))
                            goto err;
                    }
                }
            } else {
                if (!BN_div(D, M, A, B, ctx))
                    goto err;
            }

            /*-
             * Now
             *      A = D*B + M;
             * thus we have
             * (**)  sign*Y*a  ==  D*B + M   (mod |n|).
             */

            tmp = A;            /* keep the BIGNUM object, the value does not
                                 * matter */

            /* (A, B) := (B, A mod B) ... */
            A = B;
            B = M;
            /* ... so we have  0 <= B < A  again */

            /*-
             * Since the former  M  is now  B  and the former  B  is now  A,
             * (**) translates into
             *       sign*Y*a  ==  D*A + B    (mod |n|),
             * i.e.
             *       sign*Y*a - D*A  ==  B    (mod |n|).
             * Similarly, (*) translates into
             *      -sign*X*a  ==  A          (mod |n|).
             *
             * Thus,
             *   sign*Y*a + D*sign*X*a  ==  B  (mod |n|),
             * i.e.
             *        sign*(Y + D*X)*a  ==  B  (mod |n|).
             *
             * So if we set  (X, Y, sign) := (Y + D*X, X, -sign),  we arrive back at
             *      -sign*X*a  ==  B   (mod |n|),
             *       sign*Y*a  ==  A   (mod |n|).
             * Note that  X  and  Y  stay non-negative all the time.
             */

            /*
             * most of the time D is very small, so we can optimize tmp :=
             * D*X+Y
             */
            if (BN_is_one(D)) {
                if (!BN_add(tmp, X, Y))
                    goto err;
            } else {
                if (BN_is_word(D, 2)) {
                    if (!BN_lshift1(tmp, X))
                        goto err;
                } else if (BN_is_word(D, 4)) {
                    if (!BN_lshift(tmp, X, 2))
                        goto err;
                } else if (D->top == 1) {
                    if (!BN_copy(tmp, X))
                        goto err;
                    if (!BN_mul_word(tmp, D->d[0]))
                        goto err;
                } else {
                    if (!BN_mul(tmp, D, X, ctx))
                        goto err;
                }
                if (!BN_add(tmp, tmp, Y))
                    goto err;
            }

            M = Y;              /* keep the BIGNUM object, the value does not
                                 * matter */
            Y = X;
            X = tmp;
            sign = -sign;
        }
    }

    /*-
     * The while loop (Euclid's algorithm) ends when
     *      A == gcd(a,n);
     * we have
     *       sign*Y*a  ==  A  (mod |n|),
     * where  Y  is non-negative.
     */

    if (sign < 0) {
        if (!BN_sub(Y, n, Y))
            goto err;
    }
    /* Now  Y*a  ==  A  (mod |n|).  */

    if (BN_is_one(A)) {
        /* Y*a == 1  (mod |n|) */
        if (!Y->neg && BN_ucmp(Y, n) < 0) {
            if (!BN_copy(R, Y))
                goto err;
        } else {
            if (!BN_nnmod(R, Y, n, ctx))
                goto err;
        }
    } else {
        if (pnoinv)
            *pnoinv = 1;
        goto err;
    }
    ret = R;
 err:
    if ((ret == NULL) && (in == NULL))
        BN_free(R);
    BN_CTX_end(ctx);
    bn_check_top(ret);
    return (ret);
}

/*
 * BN_mod_inverse_no_branch is a special version of BN_mod_inverse. It does
 * not contain branches that may leak sensitive information.
 */
static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
                                        const BIGNUM *a, const BIGNUM *n,
                                        BN_CTX *ctx)
{
    BIGNUM *A, *B, *X, *Y, *M, *D, *T, *R = NULL;
    BIGNUM *ret = NULL;
    int sign;

    bn_check_top(a);
    bn_check_top(n);

    BN_CTX_start(ctx);
    A = BN_CTX_get(ctx);
    B = BN_CTX_get(ctx);
    X = BN_CTX_get(ctx);
    D = BN_CTX_get(ctx);
    M = BN_CTX_get(ctx);
    Y = BN_CTX_get(ctx);
    T = BN_CTX_get(ctx);
    if (T == NULL)
        goto err;

    if (in == NULL)
        R = BN_new();
    else
        R = in;
    if (R == NULL)
        goto err;

    BN_one(X);
    BN_zero(Y);
    if (BN_copy(B, a) == NULL)
        goto err;
    if (BN_copy(A, n) == NULL)
        goto err;
    A->neg = 0;

    if (B->neg || (BN_ucmp(B, A) >= 0)) {
        /*
         * Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
         * BN_div_no_branch will be called eventually.
         */
         {
            BIGNUM local_B;
            BN_init(&local_B);
            BN_with_flags(&local_B, B, BN_FLG_CONSTTIME);
            if (!BN_nnmod(B, &local_B, A, ctx))
                goto err;
            /* Ensure local_B goes out of scope before any further use of B */
        }
    }
    sign = -1;
    /*-
     * From  B = a mod |n|,  A = |n|  it follows that
     *
     *      0 <= B < A,
     *     -sign*X*a  ==  B   (mod |n|),
     *      sign*Y*a  ==  A   (mod |n|).
     */

    while (!BN_is_zero(B)) {
        BIGNUM *tmp;

        /*-
         *      0 < B < A,
         * (*) -sign*X*a  ==  B   (mod |n|),
         *      sign*Y*a  ==  A   (mod |n|)
         */

        /*
         * Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
         * BN_div_no_branch will be called eventually.
         */
        {
            BIGNUM local_A;
            BN_init(&local_A);
            BN_with_flags(&local_A, A, BN_FLG_CONSTTIME);

            /* (D, M) := (A/B, A%B) ... */
            if (!BN_div(D, M, &local_A, B, ctx))
                goto err;
            /* Ensure local_A goes out of scope before any further use of A */
        }

        /*-
         * Now
         *      A = D*B + M;
         * thus we have
         * (**)  sign*Y*a  ==  D*B + M   (mod |n|).
         */

        tmp = A;                /* keep the BIGNUM object, the value does not
                                 * matter */

        /* (A, B) := (B, A mod B) ... */
        A = B;
        B = M;
        /* ... so we have  0 <= B < A  again */

        /*-
         * Since the former  M  is now  B  and the former  B  is now  A,
         * (**) translates into
         *       sign*Y*a  ==  D*A + B    (mod |n|),
         * i.e.
         *       sign*Y*a - D*A  ==  B    (mod |n|).
         * Similarly, (*) translates into
         *      -sign*X*a  ==  A          (mod |n|).
         *
         * Thus,
         *   sign*Y*a + D*sign*X*a  ==  B  (mod |n|),
         * i.e.
         *        sign*(Y + D*X)*a  ==  B  (mod |n|).
         *
         * So if we set  (X, Y, sign) := (Y + D*X, X, -sign),  we arrive back at
         *      -sign*X*a  ==  B   (mod |n|),
         *       sign*Y*a  ==  A   (mod |n|).
         * Note that  X  and  Y  stay non-negative all the time.
         */

        if (!BN_mul(tmp, D, X, ctx))
            goto err;
        if (!BN_add(tmp, tmp, Y))
            goto err;

        M = Y;                  /* keep the BIGNUM object, the value does not
                                 * matter */
        Y = X;
        X = tmp;
        sign = -sign;
    }

    /*-
     * The while loop (Euclid's algorithm) ends when
     *      A == gcd(a,n);
     * we have
     *       sign*Y*a  ==  A  (mod |n|),
     * where  Y  is non-negative.
     */

    if (sign < 0) {
        if (!BN_sub(Y, n, Y))
            goto err;
    }
    /* Now  Y*a  ==  A  (mod |n|).  */

    if (BN_is_one(A)) {
        /* Y*a == 1  (mod |n|) */
        if (!Y->neg && BN_ucmp(Y, n) < 0) {
            if (!BN_copy(R, Y))
                goto err;
        } else {
            if (!BN_nnmod(R, Y, n, ctx))
                goto err;
        }
    } else {
        BNerr(BN_F_BN_MOD_INVERSE_NO_BRANCH, BN_R_NO_INVERSE);
        goto err;
    }
    ret = R;
 err:
    if ((ret == NULL) && (in == NULL))
        BN_free(R);
    BN_CTX_end(ctx);
    bn_check_top(ret);
    return (ret);
}
Commit	Line	Data
d02b48c6	1	/* crypto/bn/bn_gcd.c */
58964a49	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
d02b48c6 RE	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
0f113f3e	8	*
d02b48c6 RE	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
0f113f3e	15	*
d02b48c6 RE	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
0f113f3e	22	*
d02b48c6 RE	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
0f113f3e	37	* 4. If you include any Windows specific code (or a derivative thereof) from
d02b48c6 RE	38	* the apps directory (application code) you must include an acknowledgement:
d02b48c6 RE	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
0f113f3e	40	*
d02b48c6 RE	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
0f113f3e	52	*
d02b48c6 RE	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
	57	*/
dcbd0d74	58	/* ====================================================================
7d0d0996	59	* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
dcbd0d74 BM	60	*
	61	* Redistribution and use in source and binary forms, with or without
	62	* modification, are permitted provided that the following conditions
	63	* are met:
	64	*
	65	* 1. Redistributions of source code must retain the above copyright
0f113f3e	66	* notice, this list of conditions and the following disclaimer.
dcbd0d74 BM	67	*
	68	* 2. Redistributions in binary form must reproduce the above copyright
	69	* notice, this list of conditions and the following disclaimer in
	70	* the documentation and/or other materials provided with the
	71	* distribution.
	72	*
	73	* 3. All advertising materials mentioning features or use of this
	74	* software must display the following acknowledgment:
	75	* "This product includes software developed by the OpenSSL Project
	76	* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
	77	*
	78	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	79	* endorse or promote products derived from this software without
	80	* prior written permission. For written permission, please contact
	81	* openssl-core@openssl.org.
	82	*
	83	* 5. Products derived from this software may not be called "OpenSSL"
	84	* nor may "OpenSSL" appear in their names without prior written
	85	* permission of the OpenSSL Project.
	86	*
	87	* 6. Redistributions of any form whatsoever must retain the following
	88	* acknowledgment:
	89	* "This product includes software developed by the OpenSSL Project
	90	* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
	91	*
	92	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	93	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	94	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	95	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	96	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	97	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	98	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	99	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	100	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	101	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	102	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	103	* OF THE POSSIBILITY OF SUCH DAMAGE.
	104	* ====================================================================
	105	*
	106	* This product includes cryptographic software written by Eric Young
	107	* (eay@cryptsoft.com). This product includes software written by Tim
	108	* Hudson (tjh@cryptsoft.com).
	109	*
	110	*/
d02b48c6	111
b39fc560	112	#include "internal/cryptlib.h"
d02b48c6 RE	113	#include "bn_lcl.h"
d02b48c6 RE	114
d02b48c6	115	static BIGNUM euclid(BIGNUM a, BIGNUM *b);
9b141126	116
cbd48ba6	117	int BN_gcd(BIGNUM r, const BIGNUM in_a, const BIGNUM in_b, BN_CTX ctx)
0f113f3e MC	118	{
	119	BIGNUM a, b, *t;
	120	int ret = 0;
	121
	122	bn_check_top(in_a);
	123	bn_check_top(in_b);
	124
	125	BN_CTX_start(ctx);
	126	a = BN_CTX_get(ctx);
	127	b = BN_CTX_get(ctx);
	128	if (a == NULL \|\| b == NULL)
	129	goto err;
	130
	131	if (BN_copy(a, in_a) == NULL)
	132	goto err;
	133	if (BN_copy(b, in_b) == NULL)
	134	goto err;
	135	a->neg = 0;
	136	b->neg = 0;
	137
	138	if (BN_cmp(a, b) < 0) {
	139	t = a;
	140	a = b;
	141	b = t;
	142	}
	143	t = euclid(a, b);
	144	if (t == NULL)
	145	goto err;
	146
	147	if (BN_copy(r, t) == NULL)
	148	goto err;
	149	ret = 1;
	150	err:
	151	BN_CTX_end(ctx);
	152	bn_check_top(r);
	153	return (ret);
	154	}
d02b48c6	155
6b691a5c	156	static BIGNUM euclid(BIGNUM a, BIGNUM *b)
0f113f3e MC	157	{
	158	BIGNUM *t;
	159	int shifts = 0;
	160
	161	bn_check_top(a);
	162	bn_check_top(b);
	163
	164	/* 0 <= b <= a */
	165	while (!BN_is_zero(b)) {
	166	/* 0 < b <= a */
	167
	168	if (BN_is_odd(a)) {
	169	if (BN_is_odd(b)) {
	170	if (!BN_sub(a, a, b))
	171	goto err;
	172	if (!BN_rshift1(a, a))
	173	goto err;
	174	if (BN_cmp(a, b) < 0) {
	175	t = a;
	176	a = b;
	177	b = t;
	178	}
	179	} else { /* a odd - b even */
	180
	181	if (!BN_rshift1(b, b))
	182	goto err;
	183	if (BN_cmp(a, b) < 0) {
	184	t = a;
	185	a = b;
	186	b = t;
	187	}
	188	}
	189	} else { /* a is even */
	190
	191	if (BN_is_odd(b)) {
	192	if (!BN_rshift1(a, a))
	193	goto err;
	194	if (BN_cmp(a, b) < 0) {
	195	t = a;
	196	a = b;
	197	b = t;
	198	}
	199	} else { /* a even - b even */
	200
	201	if (!BN_rshift1(a, a))
	202	goto err;
	203	if (!BN_rshift1(b, b))
	204	goto err;
	205	shifts++;
	206	}
	207	}
	208	/* 0 <= b <= a */
	209	}
	210
	211	if (shifts) {
	212	if (!BN_lshift(a, a, shifts))
	213	goto err;
	214	}
	215	bn_check_top(a);
	216	return (a);
	217	err:
	218	return (NULL);
	219	}
dcbd0d74	220
d02b48c6	221	/* solves ax == 1 (mod n) */
55525742	222	static BIGNUM BN_mod_inverse_no_branch(BIGNUM in,
0f113f3e MC	223	const BIGNUM a, const BIGNUM n,
0f113f3e MC	224	BN_CTX *ctx);
879bd6e3	225
020fc820	226	BIGNUM BN_mod_inverse(BIGNUM in,
0f113f3e MC	227	const BIGNUM a, const BIGNUM n, BN_CTX *ctx)
	228	{
	229	BIGNUM *rv;
	230	int noinv;
	231	rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
	232	if (noinv)
	233	BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);
	234	return rv;
	235	}
879bd6e3 DSH	236
879bd6e3 DSH	237	BIGNUM int_bn_mod_inverse(BIGNUM in,
0f113f3e MC	238	const BIGNUM a, const BIGNUM n, BN_CTX *ctx,
	239	int *pnoinv)
	240	{
	241	BIGNUM A, B, X, Y, M, D, T, R = NULL;
	242	BIGNUM *ret = NULL;
	243	int sign;
	244
	245	if (pnoinv)
	246	*pnoinv = 0;
	247
	248	if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
	249	\|\| (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
	250	return BN_mod_inverse_no_branch(in, a, n, ctx);
	251	}
	252
	253	bn_check_top(a);
	254	bn_check_top(n);
	255
	256	BN_CTX_start(ctx);
	257	A = BN_CTX_get(ctx);
	258	B = BN_CTX_get(ctx);
	259	X = BN_CTX_get(ctx);
	260	D = BN_CTX_get(ctx);
	261	M = BN_CTX_get(ctx);
	262	Y = BN_CTX_get(ctx);
	263	T = BN_CTX_get(ctx);
	264	if (T == NULL)
	265	goto err;
	266
	267	if (in == NULL)
	268	R = BN_new();
	269	else
	270	R = in;
	271	if (R == NULL)
	272	goto err;
	273
	274	BN_one(X);
	275	BN_zero(Y);
	276	if (BN_copy(B, a) == NULL)
	277	goto err;
	278	if (BN_copy(A, n) == NULL)
	279	goto err;
	280	A->neg = 0;
	281	if (B->neg \|\| (BN_ucmp(B, A) >= 0)) {
	282	if (!BN_nnmod(B, B, A, ctx))
	283	goto err;
	284	}
	285	sign = -1;
50e735f9 MC	286	/*-
	287	* From B = a mod \|n\|, A = \|n\| it follows that
	288	*
	289	* 0 <= B < A,
	290	* -signXa == B (mod \|n\|),
	291	* signYa == A (mod \|n\|).
	292	*/
0f113f3e MC	293
	294	if (BN_is_odd(n) && (BN_num_bits(n) <= (BN_BITS <= 32 ? 450 : 2048))) {
	295	/*
	296	* Binary inversion algorithm; requires odd modulus. This is faster
	297	* than the general algorithm if the modulus is sufficiently small
	298	* (about 400 .. 500 bits on 32-bit sytems, but much more on 64-bit
	299	* systems)
	300	*/
	301	int shift;
	302
	303	while (!BN_is_zero(B)) {
50e735f9 MC	304	/*-
	305	* 0 < B < \|n\|,
	306	* 0 < A <= \|n\|,
	307	* (1) -signXa == B (mod \|n\|),
	308	* (2) signYa == A (mod \|n\|)
	309	*/
0f113f3e MC	310
	311	/*
	312	* Now divide B by the maximum possible power of two in the
	313	* integers, and divide X by the same value mod \|n\|. When we're
	314	* done, (1) still holds.
	315	*/
	316	shift = 0;
	317	while (!BN_is_bit_set(B, shift)) { /* note that 0 < B */
	318	shift++;
	319
	320	if (BN_is_odd(X)) {
	321	if (!BN_uadd(X, X, n))
	322	goto err;
	323	}
	324	/*
	325	* now X is even, so we can easily divide it by two
	326	*/
	327	if (!BN_rshift1(X, X))
	328	goto err;
	329	}
	330	if (shift > 0) {
	331	if (!BN_rshift(B, B, shift))
	332	goto err;
	333	}
	334
	335	/*
	336	* Same for A and Y. Afterwards, (2) still holds.
	337	*/
	338	shift = 0;
	339	while (!BN_is_bit_set(A, shift)) { /* note that 0 < A */
	340	shift++;
	341
	342	if (BN_is_odd(Y)) {
	343	if (!BN_uadd(Y, Y, n))
	344	goto err;
	345	}
	346	/* now Y is even */
	347	if (!BN_rshift1(Y, Y))
	348	goto err;
	349	}
	350	if (shift > 0) {
	351	if (!BN_rshift(A, A, shift))
	352	goto err;
	353	}
	354
50e735f9 MC	355	/*-
	356	* We still have (1) and (2).
	357	* Both A and B are odd.
	358	* The following computations ensure that
	359	*
	360	* 0 <= B < \|n\|,
	361	* 0 < A < \|n\|,
	362	* (1) -signXa == B (mod \|n\|),
	363	* (2) signYa == A (mod \|n\|),
	364	*
	365	* and that either A or B is even in the next iteration.
	366	*/
0f113f3e MC	367	if (BN_ucmp(B, A) >= 0) {
	368	/* -sign(X + Y)a == B - A (mod \|n\|) */
	369	if (!BN_uadd(X, X, Y))
	370	goto err;
	371	/*
	372	* NB: we could use BN_mod_add_quick(X, X, Y, n), but that
	373	* actually makes the algorithm slower
	374	*/
	375	if (!BN_usub(B, B, A))
	376	goto err;
	377	} else {
	378	/* sign(X + Y)a == A - B (mod \|n\|) */
	379	if (!BN_uadd(Y, Y, X))
	380	goto err;
	381	/*
	382	* as above, BN_mod_add_quick(Y, Y, X, n) would slow things
	383	* down
	384	*/
	385	if (!BN_usub(A, A, B))
	386	goto err;
	387	}
	388	}
	389	} else {
	390	/* general inversion algorithm */
	391
	392	while (!BN_is_zero(B)) {
	393	BIGNUM *tmp;
	394
50e735f9 MC	395	/*-
	396	* 0 < B < A,
	397	* () -signX*a == B (mod \|n\|),
	398	* signYa == A (mod \|n\|)
	399	*/
0f113f3e MC	400
	401	/* (D, M) := (A/B, A%B) ... */
	402	if (BN_num_bits(A) == BN_num_bits(B)) {
	403	if (!BN_one(D))
	404	goto err;
	405	if (!BN_sub(M, A, B))
	406	goto err;
	407	} else if (BN_num_bits(A) == BN_num_bits(B) + 1) {
	408	/* A/B is 1, 2, or 3 */
	409	if (!BN_lshift1(T, B))
	410	goto err;
	411	if (BN_ucmp(A, T) < 0) {
	412	/* A < 2B, so D=1 /
	413	if (!BN_one(D))
	414	goto err;
	415	if (!BN_sub(M, A, B))
	416	goto err;
	417	} else {
	418	/* A >= 2B, so D=2 or D=3 /
	419	if (!BN_sub(M, A, T))
	420	goto err;
	421	if (!BN_add(D, T, B))
	422	goto err; /* use D (:= 3B) as temp /
	423	if (BN_ucmp(A, D) < 0) {
	424	/* A < 3B, so D=2 /
	425	if (!BN_set_word(D, 2))
	426	goto err;
	427	/*
	428	* M (= A - 2*B) already has the correct value
	429	*/
	430	} else {
	431	/* only D=3 remains */
	432	if (!BN_set_word(D, 3))
	433	goto err;
	434	/*
	435	* currently M = A - 2B, but we need M = A - 3B
	436	*/
	437	if (!BN_sub(M, M, B))
	438	goto err;
	439	}
	440	}
	441	} else {
	442	if (!BN_div(D, M, A, B, ctx))
	443	goto err;
	444	}
	445
50e735f9 MC	446	/*-
	447	* Now
	448	* A = D*B + M;
	449	* thus we have
	450	* (*) signYa == DB + M (mod \|n\|).
	451	*/
0f113f3e MC	452
	453	tmp = A; /* keep the BIGNUM object, the value does not
	454	* matter */
	455
	456	/* (A, B) := (B, A mod B) ... */
	457	A = B;
	458	B = M;
	459	/* ... so we have 0 <= B < A again */
	460
50e735f9 MC	461	/*-
	462	* Since the former M is now B and the former B is now A,
	463	* (**) translates into
	464	* signYa == D*A + B (mod \|n\|),
	465	* i.e.
	466	* signYa - D*A == B (mod \|n\|).
	467	* Similarly, (*) translates into
	468	* -signXa == A (mod \|n\|).
	469	*
	470	* Thus,
	471	* signYa + DsignX*a == B (mod \|n\|),
	472	* i.e.
	473	* sign(Y + DX)*a == B (mod \|n\|).
	474	*
	475	* So if we set (X, Y, sign) := (Y + D*X, X, -sign), we arrive back at
	476	* -signXa == B (mod \|n\|),
	477	* signYa == A (mod \|n\|).
	478	* Note that X and Y stay non-negative all the time.
	479	*/
0f113f3e MC	480
	481	/*
	482	* most of the time D is very small, so we can optimize tmp :=
	483	* D*X+Y
	484	*/
	485	if (BN_is_one(D)) {
	486	if (!BN_add(tmp, X, Y))
	487	goto err;
	488	} else {
	489	if (BN_is_word(D, 2)) {
	490	if (!BN_lshift1(tmp, X))
	491	goto err;
	492	} else if (BN_is_word(D, 4)) {
	493	if (!BN_lshift(tmp, X, 2))
	494	goto err;
	495	} else if (D->top == 1) {
	496	if (!BN_copy(tmp, X))
	497	goto err;
	498	if (!BN_mul_word(tmp, D->d[0]))
	499	goto err;
	500	} else {
	501	if (!BN_mul(tmp, D, X, ctx))
	502	goto err;
	503	}
	504	if (!BN_add(tmp, tmp, Y))
	505	goto err;
	506	}
	507
	508	M = Y; /* keep the BIGNUM object, the value does not
	509	* matter */
	510	Y = X;
	511	X = tmp;
	512	sign = -sign;
	513	}
	514	}
	515
50e735f9 MC	516	/*-
	517	* The while loop (Euclid's algorithm) ends when
	518	* A == gcd(a,n);
	519	* we have
	520	* signYa == A (mod \|n\|),
	521	* where Y is non-negative.
	522	*/
0f113f3e MC	523
	524	if (sign < 0) {
	525	if (!BN_sub(Y, n, Y))
	526	goto err;
	527	}
	528	/* Now Ya == A (mod \|n\|). /
	529
	530	if (BN_is_one(A)) {
	531	/* Ya == 1 (mod \|n\|) /
	532	if (!Y->neg && BN_ucmp(Y, n) < 0) {
	533	if (!BN_copy(R, Y))
	534	goto err;
	535	} else {
	536	if (!BN_nnmod(R, Y, n, ctx))
	537	goto err;
	538	}
	539	} else {
	540	if (pnoinv)
	541	*pnoinv = 1;
	542	goto err;
	543	}
	544	ret = R;
	545	err:
	546	if ((ret == NULL) && (in == NULL))
	547	BN_free(R);
	548	BN_CTX_end(ctx);
	549	bn_check_top(ret);
	550	return (ret);
	551	}
	552
	553	/*
	554	* BN_mod_inverse_no_branch is a special version of BN_mod_inverse. It does
	555	* not contain branches that may leak sensitive information.
bd31fb21	556	*/
55525742	557	static BIGNUM BN_mod_inverse_no_branch(BIGNUM in,
0f113f3e MC	558	const BIGNUM a, const BIGNUM n,
	559	BN_CTX *ctx)
	560	{
	561	BIGNUM A, B, X, Y, M, D, T, R = NULL;
0f113f3e MC	562	BIGNUM *ret = NULL;
	563	int sign;
	564
	565	bn_check_top(a);
	566	bn_check_top(n);
	567
	568	BN_CTX_start(ctx);
	569	A = BN_CTX_get(ctx);
	570	B = BN_CTX_get(ctx);
	571	X = BN_CTX_get(ctx);
	572	D = BN_CTX_get(ctx);
	573	M = BN_CTX_get(ctx);
	574	Y = BN_CTX_get(ctx);
	575	T = BN_CTX_get(ctx);
	576	if (T == NULL)
	577	goto err;
	578
	579	if (in == NULL)
	580	R = BN_new();
	581	else
	582	R = in;
	583	if (R == NULL)
	584	goto err;
	585
	586	BN_one(X);
	587	BN_zero(Y);
	588	if (BN_copy(B, a) == NULL)
	589	goto err;
	590	if (BN_copy(A, n) == NULL)
	591	goto err;
	592	A->neg = 0;
	593
	594	if (B->neg \|\| (BN_ucmp(B, A) >= 0)) {
	595	/*
	596	* Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
	597	* BN_div_no_branch will be called eventually.
	598	*/
fd7d2520 MC	599	{
	600	BIGNUM local_B;
	601	BN_init(&local_B);
	602	BN_with_flags(&local_B, B, BN_FLG_CONSTTIME);
	603	if (!BN_nnmod(B, &local_B, A, ctx))
	604	goto err;
	605	/* Ensure local_B goes out of scope before any further use of B */
	606	}
0f113f3e MC	607	}
0f113f3e MC	608	sign = -1;
50e735f9 MC	609	/*-
	610	* From B = a mod \|n\|, A = \|n\| it follows that
	611	*
	612	* 0 <= B < A,
	613	* -signXa == B (mod \|n\|),
	614	* signYa == A (mod \|n\|).
	615	*/
0f113f3e MC	616
	617	while (!BN_is_zero(B)) {
	618	BIGNUM *tmp;
	619
50e735f9 MC	620	/*-
	621	* 0 < B < A,
	622	* () -signX*a == B (mod \|n\|),
	623	* signYa == A (mod \|n\|)
	624	*/
0f113f3e MC	625
	626	/*
	627	* Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
	628	* BN_div_no_branch will be called eventually.
	629	*/
fd7d2520 MC	630	{
	631	BIGNUM local_A;
	632	BN_init(&local_A);
	633	BN_with_flags(&local_A, A, BN_FLG_CONSTTIME);
0f113f3e	634
fd7d2520 MC	635	/* (D, M) := (A/B, A%B) ... */
	636	if (!BN_div(D, M, &local_A, B, ctx))
	637	goto err;
	638	/* Ensure local_A goes out of scope before any further use of A */
	639	}
0f113f3e	640
50e735f9 MC	641	/*-
	642	* Now
	643	* A = D*B + M;
	644	* thus we have
	645	* (*) signYa == DB + M (mod \|n\|).
	646	*/
0f113f3e MC	647
	648	tmp = A; /* keep the BIGNUM object, the value does not
	649	* matter */
	650
	651	/* (A, B) := (B, A mod B) ... */
	652	A = B;
	653	B = M;
	654	/* ... so we have 0 <= B < A again */
	655
50e735f9 MC	656	/*-
	657	* Since the former M is now B and the former B is now A,
	658	* (**) translates into
	659	* signYa == D*A + B (mod \|n\|),
	660	* i.e.
	661	* signYa - D*A == B (mod \|n\|).
	662	* Similarly, (*) translates into
	663	* -signXa == A (mod \|n\|).
	664	*
	665	* Thus,
	666	* signYa + DsignX*a == B (mod \|n\|),
	667	* i.e.
	668	* sign(Y + DX)*a == B (mod \|n\|).
	669	*
	670	* So if we set (X, Y, sign) := (Y + D*X, X, -sign), we arrive back at
	671	* -signXa == B (mod \|n\|),
	672	* signYa == A (mod \|n\|).
	673	* Note that X and Y stay non-negative all the time.
	674	*/
0f113f3e MC	675
	676	if (!BN_mul(tmp, D, X, ctx))
	677	goto err;
	678	if (!BN_add(tmp, tmp, Y))
	679	goto err;
	680
	681	M = Y; /* keep the BIGNUM object, the value does not
	682	* matter */
	683	Y = X;
	684	X = tmp;
	685	sign = -sign;
	686	}
	687
50e735f9 MC	688	/*-
	689	* The while loop (Euclid's algorithm) ends when
	690	* A == gcd(a,n);
	691	* we have
	692	* signYa == A (mod \|n\|),
	693	* where Y is non-negative.
	694	*/
0f113f3e MC	695
	696	if (sign < 0) {
	697	if (!BN_sub(Y, n, Y))
	698	goto err;
	699	}
	700	/* Now Ya == A (mod \|n\|). /
	701
	702	if (BN_is_one(A)) {
	703	/* Ya == 1 (mod \|n\|) /
	704	if (!Y->neg && BN_ucmp(Y, n) < 0) {
	705	if (!BN_copy(R, Y))
	706	goto err;
	707	} else {
	708	if (!BN_nnmod(R, Y, n, ctx))
	709	goto err;
	710	}
	711	} else {
	712	BNerr(BN_F_BN_MOD_INVERSE_NO_BRANCH, BN_R_NO_INVERSE);
	713	goto err;
	714	}
	715	ret = R;
	716	err:
	717	if ((ret == NULL) && (in == NULL))
	718	BN_free(R);
	719	BN_CTX_end(ctx);
	720	bn_check_top(ret);
	721	return (ret);
	722	}