]> git.ipfire.org Git - thirdparty/openssl.git/blob - test/bntest.c
projects / thirdparty / openssl.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Fix compiler warnings
[thirdparty/openssl.git] / test / bntest.c
1 /*
2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9 #include <assert.h>
10 #include <errno.h>
11 #include <stdio.h>
12 #include <string.h>
13 #include <ctype.h>
14
15 #include "e_os.h"
16 #include <internal/numbers.h>
17 #include <openssl/bn.h>
18 #include <openssl/crypto.h>
19 #include <openssl/err.h>
20 #include <openssl/rand.h>
21 #include "testutil.h"
22
23 /*
24 * In bn_lcl.h, bn_expand() is defined as a static ossl_inline function.
25 * This is fine in itself, it will end up as an unused static function in
26 * the worst case. However, it references bn_expand2(), which is a private
27 * function in libcrypto and therefore unavailable on some systems. This
28 * may result in a linker error because of unresolved symbols.
29 *
30 * To avoid this, we define a dummy variant of bn_expand2() here, and to
31 * avoid possible clashes with libcrypto, we rename it first, using a macro.
32 */
33 #define bn_expand2 dummy_bn_expand2
34 BIGNUM *bn_expand2(BIGNUM *b, int words);
35 BIGNUM *bn_expand2(BIGNUM *b, int words) { return NULL; }
36 #include "../crypto/bn/bn_lcl.h"
37
38 /*
39 * Things in boring, not in openssl. TODO we should add them.
40 */
41 #define HAVE_BN_PADDED 0
42 #define HAVE_BN_SQRT 0
43
44 typedef struct filetest_st {
45 const char *name;
46 int (*func)(STANZA *s);
47 } FILETEST;
48
49 typedef struct mpitest_st {
50 const char *base10;
51 const char *mpi;
52 size_t mpi_len;
53 } MPITEST;
54
55 static const int NUM0 = 100; /* number of tests */
56 static const int NUM1 = 50; /* additional tests for some functions */
57 static BN_CTX *ctx;
58
59 /*
60 * Polynomial coefficients used in GFM tests.
61 */
62 static int p0[] = { 163, 7, 6, 3, 0, -1 };
63 static int p1[] = { 193, 15, 0, -1 };
64
65
66 /*
67 * Look for |key| in the stanza and return it or NULL if not found.
68 */
69 static const char *findattr(STANZA *s, const char *key)
70 {
71 int i = s->numpairs;
72 PAIR *pp = s->pairs;
73
74 for ( ; --i >= 0; pp++)
75 if (strcasecmp(pp->key, key) == 0)
76 return pp->value;
77 return NULL;
78 }
79
80 /*
81 * Parse BIGNUM, return number of bytes parsed.
82 */
83 static int parseBN(BIGNUM **out, const char *in)
84 {
85 *out = NULL;
86 return BN_hex2bn(out, in);
87 }
88
89 static int parsedecBN(BIGNUM **out, const char *in)
90 {
91 *out = NULL;
92 return BN_dec2bn(out, in);
93 }
94
95 static BIGNUM *getBN(STANZA *s, const char *attribute)
96 {
97 const char *hex;
98 BIGNUM *ret = NULL;
99
100 if ((hex = findattr(s, attribute)) == NULL) {
101 TEST_error("%s:%d: Can't find %s", s->test_file, s->start, attribute);
102 return NULL;
103 }
104
105 if (parseBN(&ret, hex) != (int)strlen(hex)) {
106 TEST_error("Could not decode '%s'", hex);
107 return NULL;
108 }
109 return ret;
110 }
111
112 static int getint(STANZA *s, int *out, const char *attribute)
113 {
114 BIGNUM *ret;
115 BN_ULONG word;
116 int st = 0;
117
118 if (!TEST_ptr(ret = getBN(s, attribute))
119 || !TEST_ulong_le(word = BN_get_word(ret), INT_MAX))
120 goto err;
121
122 *out = (int)word;
123 st = 1;
124 err:
125 BN_free(ret);
126 return st;
127 }
128
129 static int equalBN(const char *op, const BIGNUM *expected, const BIGNUM *actual)
130 {
131 if (BN_cmp(expected, actual) == 0)
132 return 1;
133
134 TEST_error("unexpected %s value", op);
135 TEST_BN_eq(expected, actual);
136 return 0;
137 }
138
139
140 /*
141 * Return a "random" flag for if a BN should be negated.
142 */
143 static int rand_neg(void)
144 {
145 static unsigned int neg = 0;
146 static int sign[8] = { 0, 0, 0, 1, 1, 0, 1, 1 };
147
148 return sign[(neg++) % 8];
149 }
150
151
152 static int test_sub()
153 {
154 BIGNUM *a = NULL, *b = NULL, *c = NULL;
155 int i, st = 0;
156
157 if (!TEST_ptr(a = BN_new())
158 || !TEST_ptr(b = BN_new())
159 || !TEST_ptr(c = BN_new()))
160 goto err;
161
162 for (i = 0; i < NUM0 + NUM1; i++) {
163 if (i < NUM1) {
164 BN_bntest_rand(a, 512, 0, 0);
165 BN_copy(b, a);
166 if (!TEST_int_ne(BN_set_bit(a, i), 0))
167 goto err;
168 BN_add_word(b, i);
169 } else {
170 BN_bntest_rand(b, 400 + i - NUM1, 0, 0);
171 a->neg = rand_neg();
172 b->neg = rand_neg();
173 }
174 BN_sub(c, a, b);
175 BN_add(c, c, b);
176 BN_sub(c, c, a);
177 if (!TEST_BN_eq_zero(c))
178 goto err;
179 }
180 st = 1;
181 err:
182 BN_free(a);
183 BN_free(b);
184 BN_free(c);
185 return st;
186 }
187
188
189 static int test_div_recip()
190 {
191 BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL, *e = NULL;
192 BN_RECP_CTX *recp = NULL;
193 int st = 0, i;
194
195 if (!TEST_ptr(a = BN_new())
196 || !TEST_ptr(b = BN_new())
197 || !TEST_ptr(c = BN_new())
198 || !TEST_ptr(d = BN_new())
199 || !TEST_ptr(e = BN_new())
200 || !TEST_ptr(recp = BN_RECP_CTX_new()))
201 goto err;
202
203 for (i = 0; i < NUM0 + NUM1; i++) {
204 if (i < NUM1) {
205 BN_bntest_rand(a, 400, 0, 0);
206 BN_copy(b, a);
207 BN_lshift(a, a, i);
208 BN_add_word(a, i);
209 } else
210 BN_bntest_rand(b, 50 + 3 * (i - NUM1), 0, 0);
211 a->neg = rand_neg();
212 b->neg = rand_neg();
213 BN_RECP_CTX_set(recp, b, ctx);
214 BN_div_recp(d, c, a, recp, ctx);
215 BN_mul(e, d, b, ctx);
216 BN_add(d, e, c);
217 BN_sub(d, d, a);
218 if (!TEST_BN_eq_zero(d))
219 goto err;
220 }
221 st = 1;
222 err:
223 BN_free(a);
224 BN_free(b);
225 BN_free(c);
226 BN_free(d);
227 BN_free(e);
228 BN_RECP_CTX_free(recp);
229 return st;
230 }
231
232
233 static int test_mod()
234 {
235 BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL, *e = NULL;
236 int st = 0, i;
237
238 if (!TEST_ptr(a = BN_new())
239 || !TEST_ptr(b = BN_new())
240 || !TEST_ptr(c = BN_new())
241 || !TEST_ptr(d = BN_new())
242 || !TEST_ptr(e = BN_new()))
243 goto err;
244
245 BN_bntest_rand(a, 1024, 0, 0);
246 for (i = 0; i < NUM0; i++) {
247 BN_bntest_rand(b, 450 + i * 10, 0, 0);
248 a->neg = rand_neg();
249 b->neg = rand_neg();
250 BN_mod(c, a, b, ctx);
251 BN_div(d, e, a, b, ctx);
252 BN_sub(e, e, c);
253 if (!TEST_BN_eq_zero(e))
254 goto err;
255 }
256 st = 1;
257 err:
258 BN_free(a);
259 BN_free(b);
260 BN_free(c);
261 BN_free(d);
262 BN_free(e);
263 return st;
264 }
265
266 static const char *bn1strings[] = {
267 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
268 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
269 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
270 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
271 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
272 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
273 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
274 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000000000FFFFFFFF00",
275 "0000000000000000000000000000000000000000000000000000000000000000",
276 "0000000000000000000000000000000000000000000000000000000000000000",
277 "0000000000000000000000000000000000000000000000000000000000000000",
278 "0000000000000000000000000000000000000000000000000000000000000000",
279 "0000000000000000000000000000000000000000000000000000000000000000",
280 "0000000000000000000000000000000000000000000000000000000000000000",
281 "0000000000000000000000000000000000000000000000000000000000000000",
282 "00000000000000000000000000000000000000000000000000FFFFFFFFFFFFFF",
283 NULL
284 };
285
286 static const char *bn2strings[] = {
287 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
288 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
289 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
290 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
291 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
292 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
293 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
294 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000000000FFFFFFFF0000000000",
295 "0000000000000000000000000000000000000000000000000000000000000000",
296 "0000000000000000000000000000000000000000000000000000000000000000",
297 "0000000000000000000000000000000000000000000000000000000000000000",
298 "0000000000000000000000000000000000000000000000000000000000000000",
299 "0000000000000000000000000000000000000000000000000000000000000000",
300 "0000000000000000000000000000000000000000000000000000000000000000",
301 "0000000000000000000000000000000000000000000000000000000000000000",
302 "000000000000000000000000000000000000000000FFFFFFFFFFFFFF00000000",
303 NULL
304 };
305
306 static char *glue(const char *list[])
307 {
308 size_t len = 0;
309 char *p, *save;
310 int i;
311
312 for (i = 0; list[i] != NULL; i++)
313 len += strlen(list[i]);
314 if (!TEST_ptr(p = save = OPENSSL_malloc(len + 1)))
315 return NULL;
316 for (i = 0; list[i] != NULL; i++)
317 p += strlen(strcpy(p, list[i]));
318 return save;
319 }
320
321 /*
322 * Test constant-time modular exponentiation with 1024-bit inputs, which on
323 * x86_64 cause a different code branch to be taken.
324 */
325 static int test_modexp_mont5()
326 {
327 BIGNUM *a = NULL, *p = NULL, *m = NULL, *d = NULL, *e = NULL;
328 BIGNUM *b = NULL, *n = NULL, *c = NULL;
329 BN_MONT_CTX *mont = NULL;
330 char *bigstring;
331 int st = 0;
332
333 if (!TEST_ptr(a = BN_new())
334 || !TEST_ptr(p = BN_new())
335 || !TEST_ptr(m = BN_new())
336 || !TEST_ptr(d = BN_new())
337 || !TEST_ptr(e = BN_new())
338 || !TEST_ptr(b = BN_new())
339 || !TEST_ptr(n = BN_new())
340 || !TEST_ptr(c = BN_new())
341 || !TEST_ptr(mont = BN_MONT_CTX_new()))
342 goto err;
343
344 BN_bntest_rand(m, 1024, 0, 1); /* must be odd for montgomery */
345 /* Zero exponent */
346 BN_bntest_rand(a, 1024, 0, 0);
347 BN_zero(p);
348 if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL)))
349 goto err;
350 if (!TEST_BN_eq_one(d))
351 goto err;
352
353 /* Regression test for carry bug in mulx4x_mont */
354 BN_hex2bn(&a,
355 "7878787878787878787878787878787878787878787878787878787878787878"
356 "7878787878787878787878787878787878787878787878787878787878787878"
357 "7878787878787878787878787878787878787878787878787878787878787878"
358 "7878787878787878787878787878787878787878787878787878787878787878");
359 BN_hex2bn(&b,
360 "095D72C08C097BA488C5E439C655A192EAFB6380073D8C2664668EDDB4060744"
361 "E16E57FB4EDB9AE10A0CEFCDC28A894F689A128379DB279D48A2E20849D68593"
362 "9B7803BCF46CEBF5C533FB0DD35B080593DE5472E3FE5DB951B8BFF9B4CB8F03"
363 "9CC638A5EE8CDD703719F8000E6A9F63BEED5F2FCD52FF293EA05A251BB4AB81");
364 BN_hex2bn(&n,
365 "D78AF684E71DB0C39CFF4E64FB9DB567132CB9C50CC98009FEB820B26F2DED9B"
366 "91B9B5E2B83AE0AE4EB4E0523CA726BFBE969B89FD754F674CE99118C3F2D1C5"
367 "D81FDC7C54E02B60262B241D53C040E99E45826ECA37A804668E690E1AFC1CA4"
368 "2C9A15D84D4954425F0B7642FC0BD9D7B24E2618D2DCC9B729D944BADACFDDAF");
369 BN_MONT_CTX_set(mont, n, ctx);
370 BN_mod_mul_montgomery(c, a, b, mont, ctx);
371 BN_mod_mul_montgomery(d, b, a, mont, ctx);
372 if (!TEST_BN_eq(c, d))
373 goto err;
374
375 /* Regression test for carry bug in sqr[x]8x_mont */
376 bigstring = glue(bn1strings);
377 BN_hex2bn(&n, bigstring);
378 OPENSSL_free(bigstring);
379 bigstring = glue(bn2strings);
380 BN_hex2bn(&a, bigstring);
381 OPENSSL_free(bigstring);
382 BN_free(b);
383 b = BN_dup(a);
384 BN_MONT_CTX_set(mont, n, ctx);
385 BN_mod_mul_montgomery(c, a, a, mont, ctx);
386 BN_mod_mul_montgomery(d, a, b, mont, ctx);
387 if (!TEST_BN_eq(c, d))
388 goto err;
389
390 /* Zero input */
391 BN_bntest_rand(p, 1024, 0, 0);
392 BN_zero(a);
393 if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))
394 || !TEST_BN_eq_zero(d))
395 goto err;
396
397 /*
398 * Craft an input whose Montgomery representation is 1, i.e., shorter
399 * than the modulus m, in order to test the const time precomputation
400 * scattering/gathering.
401 */
402 BN_one(a);
403 BN_MONT_CTX_set(mont, m, ctx);
404 if (!TEST_true(BN_from_montgomery(e, a, mont, ctx))
405 || !TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))
406 || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))
407 || !TEST_BN_eq(a, d))
408 goto err;
409
410 /* Finally, some regular test vectors. */
411 BN_bntest_rand(e, 1024, 0, 0);
412 if (!TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))
413 || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))
414 || !TEST_BN_eq(a, d))
415 goto err;
416
417 st = 1;
418
419 err:
420 BN_MONT_CTX_free(mont);
421 BN_free(a);
422 BN_free(p);
423 BN_free(m);
424 BN_free(d);
425 BN_free(e);
426 BN_free(b);
427 BN_free(n);
428 BN_free(c);
429 return st;
430 }
431
432 #ifndef OPENSSL_NO_EC2M
433 static int test_gf2m_add()
434 {
435 BIGNUM *a = NULL, *b = NULL, *c = NULL;
436 int i, st = 0;
437
438 if (!TEST_ptr(a = BN_new())
439 || !TEST_ptr(b = BN_new())
440 || !TEST_ptr(c = BN_new()))
441 goto err;
442
443 for (i = 0; i < NUM0; i++) {
444 BN_rand(a, 512, 0, 0);
445 BN_copy(b, BN_value_one());
446 a->neg = rand_neg();
447 b->neg = rand_neg();
448 BN_GF2m_add(c, a, b);
449 /* Test that two added values have the correct parity. */
450 if (!TEST_false((BN_is_odd(a) && BN_is_odd(c))
451 || (!BN_is_odd(a) && !BN_is_odd(c))))
452 goto err;
453 BN_GF2m_add(c, c, c);
454 /* Test that c + c = 0. */
455 if (!TEST_BN_eq_zero(c))
456 goto err;
457 }
458 st = 1;
459 err:
460 BN_free(a);
461 BN_free(b);
462 BN_free(c);
463 return st;
464 }
465
466 static int test_gf2m_mod()
467 {
468 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL, *e = NULL;
469 int i, j, st = 0;
470
471 if (!TEST_ptr(a = BN_new())
472 || !TEST_ptr(b[0] = BN_new())
473 || !TEST_ptr(b[1] = BN_new())
474 || !TEST_ptr(c = BN_new())
475 || !TEST_ptr(d = BN_new())
476 || !TEST_ptr(e = BN_new()))
477 goto err;
478
479 BN_GF2m_arr2poly(p0, b[0]);
480 BN_GF2m_arr2poly(p1, b[1]);
481
482 for (i = 0; i < NUM0; i++) {
483 BN_bntest_rand(a, 1024, 0, 0);
484 for (j = 0; j < 2; j++) {
485 BN_GF2m_mod(c, a, b[j]);
486 BN_GF2m_add(d, a, c);
487 BN_GF2m_mod(e, d, b[j]);
488 /* Test that a + (a mod p) mod p == 0. */
489 if (!TEST_BN_eq_zero(e))
490 goto err;
491 }
492 }
493 st = 1;
494 err:
495 BN_free(a);
496 BN_free(b[0]);
497 BN_free(b[1]);
498 BN_free(c);
499 BN_free(d);
500 BN_free(e);
501 return st;
502 }
503
504 static int test_gf2m_mul()
505 {
506 BIGNUM *a, *b[2] = {NULL, NULL}, *c = NULL, *d = NULL;
507 BIGNUM *e = NULL, *f = NULL, *g = NULL, *h = NULL;
508 int i, j, st = 0;
509
510 if (!TEST_ptr(a = BN_new())
511 || !TEST_ptr(b[0] = BN_new())
512 || !TEST_ptr(b[1] = BN_new())
513 || !TEST_ptr(c = BN_new())
514 || !TEST_ptr(d = BN_new())
515 || !TEST_ptr(e = BN_new())
516 || !TEST_ptr(f = BN_new())
517 || !TEST_ptr(g = BN_new())
518 || !TEST_ptr(h = BN_new()))
519 goto err;
520
521 BN_GF2m_arr2poly(p0, b[0]);
522 BN_GF2m_arr2poly(p1, b[1]);
523
524 for (i = 0; i < NUM0; i++) {
525 BN_bntest_rand(a, 1024, 0, 0);
526 BN_bntest_rand(c, 1024, 0, 0);
527 BN_bntest_rand(d, 1024, 0, 0);
528 for (j = 0; j < 2; j++) {
529 BN_GF2m_mod_mul(e, a, c, b[j], ctx);
530 BN_GF2m_add(f, a, d);
531 BN_GF2m_mod_mul(g, f, c, b[j], ctx);
532 BN_GF2m_mod_mul(h, d, c, b[j], ctx);
533 BN_GF2m_add(f, e, g);
534 BN_GF2m_add(f, f, h);
535 /* Test that (a+d)*c = a*c + d*c. */
536 if (!TEST_BN_eq_zero(f))
537 goto err;
538 }
539 }
540 st = 1;
541
542 err:
543 BN_free(a);
544 BN_free(b[0]);
545 BN_free(b[1]);
546 BN_free(c);
547 BN_free(d);
548 BN_free(e);
549 BN_free(f);
550 BN_free(g);
551 BN_free(h);
552 return st;
553 }
554
555 static int test_gf2m_sqr()
556 {
557 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
558 int i, j, st = 0;
559
560 if (!TEST_ptr(a = BN_new())
561 || !TEST_ptr(b[0] = BN_new())
562 || !TEST_ptr(b[1] = BN_new())
563 || !TEST_ptr(c = BN_new())
564 || !TEST_ptr(d = BN_new()))
565 goto err;
566
567 BN_GF2m_arr2poly(p0, b[0]);
568 BN_GF2m_arr2poly(p1, b[1]);
569
570 for (i = 0; i < NUM0; i++) {
571 BN_bntest_rand(a, 1024, 0, 0);
572 for (j = 0; j < 2; j++) {
573 BN_GF2m_mod_sqr(c, a, b[j], ctx);
574 BN_copy(d, a);
575 BN_GF2m_mod_mul(d, a, d, b[j], ctx);
576 BN_GF2m_add(d, c, d);
577 /* Test that a*a = a^2. */
578 if (!TEST_BN_eq_zero(d))
579 goto err;
580 }
581 }
582 st = 1;
583 err:
584 BN_free(a);
585 BN_free(b[0]);
586 BN_free(b[1]);
587 BN_free(c);
588 BN_free(d);
589 return st;
590 }
591
592 static int test_gf2m_modinv()
593 {
594 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
595 int i, j, st = 0;
596
597 if (!TEST_ptr(a = BN_new())
598 || !TEST_ptr(b[0] = BN_new())
599 || !TEST_ptr(b[1] = BN_new())
600 || !TEST_ptr(c = BN_new())
601 || !TEST_ptr(d = BN_new()))
602 goto err;
603
604 BN_GF2m_arr2poly(p0, b[0]);
605 BN_GF2m_arr2poly(p1, b[1]);
606
607 for (i = 0; i < NUM0; i++) {
608 BN_bntest_rand(a, 512, 0, 0);
609 for (j = 0; j < 2; j++) {
610 BN_GF2m_mod_inv(c, a, b[j], ctx);
611 BN_GF2m_mod_mul(d, a, c, b[j], ctx);
612 /* Test that ((1/a)*a) = 1. */
613 if (!TEST_BN_eq_one(d))
614 goto err;
615 }
616 }
617 st = 1;
618 err:
619 BN_free(a);
620 BN_free(b[0]);
621 BN_free(b[1]);
622 BN_free(c);
623 BN_free(d);
624 return st;
625 }
626
627 static int test_gf2m_moddiv()
628 {
629 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
630 BIGNUM *e = NULL, *f = NULL;
631 int i, j, st = 0;
632
633 if (!TEST_ptr(a = BN_new())
634 || !TEST_ptr(b[0] = BN_new())
635 || !TEST_ptr(b[1] = BN_new())
636 || !TEST_ptr(c = BN_new())
637 || !TEST_ptr(d = BN_new())
638 || !TEST_ptr(e = BN_new())
639 || !TEST_ptr(f = BN_new()))
640 goto err;
641
642 BN_GF2m_arr2poly(p0, b[0]);
643 BN_GF2m_arr2poly(p1, b[1]);
644
645 for (i = 0; i < NUM0; i++) {
646 BN_bntest_rand(a, 512, 0, 0);
647 BN_bntest_rand(c, 512, 0, 0);
648 for (j = 0; j < 2; j++) {
649 BN_GF2m_mod_div(d, a, c, b[j], ctx);
650 BN_GF2m_mod_mul(e, d, c, b[j], ctx);
651 BN_GF2m_mod_div(f, a, e, b[j], ctx);
652 /* Test that ((a/c)*c)/a = 1. */
653 if (!TEST_BN_eq_one(f))
654 goto err;
655 }
656 }
657 st = 1;
658 err:
659 BN_free(a);
660 BN_free(b[0]);
661 BN_free(b[1]);
662 BN_free(c);
663 BN_free(d);
664 BN_free(e);
665 BN_free(f);
666 return st;
667 }
668
669 static int test_gf2m_modexp()
670 {
671 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
672 BIGNUM *e = NULL, *f = NULL;
673 int i, j, st = 0;
674
675 if (!TEST_ptr(a = BN_new())
676 || !TEST_ptr(b[0] = BN_new())
677 || !TEST_ptr(b[1] = BN_new())
678 || !TEST_ptr(c = BN_new())
679 || !TEST_ptr(d = BN_new())
680 || !TEST_ptr(e = BN_new())
681 || !TEST_ptr(f = BN_new()))
682 goto err;
683
684 BN_GF2m_arr2poly(p0, b[0]);
685 BN_GF2m_arr2poly(p1, b[1]);
686
687 for (i = 0; i < NUM0; i++) {
688 BN_bntest_rand(a, 512, 0, 0);
689 BN_bntest_rand(c, 512, 0, 0);
690 BN_bntest_rand(d, 512, 0, 0);
691 for (j = 0; j < 2; j++) {
692 BN_GF2m_mod_exp(e, a, c, b[j], ctx);
693 BN_GF2m_mod_exp(f, a, d, b[j], ctx);
694 BN_GF2m_mod_mul(e, e, f, b[j], ctx);
695 BN_add(f, c, d);
696 BN_GF2m_mod_exp(f, a, f, b[j], ctx);
697 BN_GF2m_add(f, e, f);
698 /* Test that a^(c+d)=a^c*a^d. */
699 if (!TEST_BN_eq_zero(f))
700 goto err;
701 }
702 }
703 st = 1;
704 err:
705 BN_free(a);
706 BN_free(b[0]);
707 BN_free(b[1]);
708 BN_free(c);
709 BN_free(d);
710 BN_free(e);
711 BN_free(f);
712 return st;
713 }
714
715 static int test_gf2m_modsqrt()
716 {
717 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
718 BIGNUM *e = NULL, *f = NULL;
719 int i, j, st = 0;
720
721 if (!TEST_ptr(a = BN_new())
722 || !TEST_ptr(b[0] = BN_new())
723 || !TEST_ptr(b[1] = BN_new())
724 || !TEST_ptr(c = BN_new())
725 || !TEST_ptr(d = BN_new())
726 || !TEST_ptr(e = BN_new())
727 || !TEST_ptr(f = BN_new()))
728 goto err;
729
730 BN_GF2m_arr2poly(p0, b[0]);
731 BN_GF2m_arr2poly(p1, b[1]);
732
733 for (i = 0; i < NUM0; i++) {
734 BN_bntest_rand(a, 512, 0, 0);
735 for (j = 0; j < 2; j++) {
736 BN_GF2m_mod(c, a, b[j]);
737 BN_GF2m_mod_sqrt(d, a, b[j], ctx);
738 BN_GF2m_mod_sqr(e, d, b[j], ctx);
739 BN_GF2m_add(f, c, e);
740 /* Test that d^2 = a, where d = sqrt(a). */
741 if (!TEST_BN_eq_zero(f))
742 goto err;
743 }
744 }
745 st = 1;
746 err:
747 BN_free(a);
748 BN_free(b[0]);
749 BN_free(b[1]);
750 BN_free(c);
751 BN_free(d);
752 BN_free(e);
753 BN_free(f);
754 return st;
755 }
756
757 static int test_gf2m_modsolvequad()
758 {
759 BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
760 BIGNUM *e = NULL;
761 int i, j, s = 0, t, st = 0;
762
763 if (!TEST_ptr(a = BN_new())
764 || !TEST_ptr(b[0] = BN_new())
765 || !TEST_ptr(b[1] = BN_new())
766 || !TEST_ptr(c = BN_new())
767 || !TEST_ptr(d = BN_new())
768 || !TEST_ptr(e = BN_new()))
769 goto err;
770
771 BN_GF2m_arr2poly(p0, b[0]);
772 BN_GF2m_arr2poly(p1, b[1]);
773
774 for (i = 0; i < NUM0; i++) {
775 BN_bntest_rand(a, 512, 0, 0);
776 for (j = 0; j < 2; j++) {
777 t = BN_GF2m_mod_solve_quad(c, a, b[j], ctx);
778 if (t) {
779 s++;
780 BN_GF2m_mod_sqr(d, c, b[j], ctx);
781 BN_GF2m_add(d, c, d);
782 BN_GF2m_mod(e, a, b[j]);
783 BN_GF2m_add(e, e, d);
784 /*
785 * Test that solution of quadratic c satisfies c^2 + c = a.
786 */
787 if (!TEST_BN_eq_zero(e))
788 goto err;
789 }
790 }
791 }
792 if (!TEST_int_ge(s, 0)) {
793 TEST_info("%d tests found no roots; probably an error", NUM0);
794 goto err;
795 }
796 st = 1;
797 err:
798 BN_free(a);
799 BN_free(b[0]);
800 BN_free(b[1]);
801 BN_free(c);
802 BN_free(d);
803 BN_free(e);
804 return st;
805 }
806 #endif
807
808 static int test_kronecker()
809 {
810 BIGNUM *a = NULL, *b = NULL, *r = NULL, *t = NULL;
811 int i, legendre, kronecker, st = 0;
812
813 if (!TEST_ptr(a = BN_new())
814 || !TEST_ptr(b = BN_new())
815 || !TEST_ptr(r = BN_new())
816 || !TEST_ptr(t = BN_new()))
817 goto err;
818
819 /*
820 * We test BN_kronecker(a, b, ctx) just for b odd (Jacobi symbol). In
821 * this case we know that if b is prime, then BN_kronecker(a, b, ctx) is
822 * congruent to $a^{(b-1)/2}$, modulo $b$ (Legendre symbol). So we
823 * generate a random prime b and compare these values for a number of
824 * random a's. (That is, we run the Solovay-Strassen primality test to
825 * confirm that b is prime, except that we don't want to test whether b
826 * is prime but whether BN_kronecker works.)
827 */
828
829 if (!TEST_true(BN_generate_prime_ex(b, 512, 0, NULL, NULL, NULL)))
830 goto err;
831 b->neg = rand_neg();
832
833 for (i = 0; i < NUM0; i++) {
834 if (!TEST_true(BN_bntest_rand(a, 512, 0, 0)))
835 goto err;
836 a->neg = rand_neg();
837
838 /* t := (|b|-1)/2 (note that b is odd) */
839 if (!TEST_true(BN_copy(t, b)))
840 goto err;
841 t->neg = 0;
842 if (!TEST_true(BN_sub_word(t, 1)))
843 goto err;
844 if (!TEST_true(BN_rshift1(t, t)))
845 goto err;
846 /* r := a^t mod b */
847 b->neg = 0;
848
849 if (!TEST_true(BN_mod_exp_recp(r, a, t, b, ctx)))
850 goto err;
851 b->neg = 1;
852
853 if (BN_is_word(r, 1))
854 legendre = 1;
855 else if (BN_is_zero(r))
856 legendre = 0;
857 else {
858 if (!TEST_true(BN_add_word(r, 1)))
859 goto err;
860 if (!TEST_int_eq(BN_ucmp(r, b), 0)) {
861 TEST_info("Legendre symbol computation failed");
862 goto err;
863 }
864 legendre = -1;
865 }
866
867 if (!TEST_int_ge(kronecker = BN_kronecker(a, b, ctx), -1))
868 goto err;
869 /* we actually need BN_kronecker(a, |b|) */
870 if (a->neg && b->neg)
871 kronecker = -kronecker;
872
873 if (!TEST_int_eq(legendre, kronecker))
874 goto err;
875 }
876
877 st = 1;
878 err:
879 BN_free(a);
880 BN_free(b);
881 BN_free(r);
882 BN_free(t);
883 return st;
884 }
885
886 static int file_sum(STANZA *s)
887 {
888 BIGNUM *a = NULL, *b = NULL, *sum = NULL, *ret = NULL;
889 BN_ULONG b_word;
890 int st = 0;
891
892 if (!TEST_ptr(a = getBN(s, "A"))
893 || !TEST_ptr(b = getBN(s, "B"))
894 || !TEST_ptr(sum = getBN(s, "Sum"))
895 || !TEST_ptr(ret = BN_new()))
896 goto err;
897
898 if (!TEST_true(BN_add(ret, a, b))
899 || !equalBN("A + B", sum, ret)
900 || !TEST_true(BN_sub(ret, sum, a))
901 || !equalBN("Sum - A", b, ret)
902 || !TEST_true(BN_sub(ret, sum, b))
903 || !equalBN("Sum - B", a, ret))
904 goto err;
905
906 /*
907 * Test that the functions work when |r| and |a| point to the same BIGNUM,
908 * or when |r| and |b| point to the same BIGNUM.
909 * TODO: Test where all of |r|, |a|, and |b| point to the same BIGNUM.
910 */
911 if (!TEST_true(BN_copy(ret, a))
912 || !TEST_true(BN_add(ret, ret, b))
913 || !equalBN("A + B (r is a)", sum, ret)
914 || !TEST_true(BN_copy(ret, b))
915 || !TEST_true(BN_add(ret, a, ret))
916 || !equalBN("A + B (r is b)", sum, ret)
917 || !TEST_true(BN_copy(ret, sum))
918 || !TEST_true(BN_sub(ret, ret, a))
919 || !equalBN("Sum - A (r is a)", b, ret)
920 || !TEST_true(BN_copy(ret, a))
921 || !TEST_true(BN_sub(ret, sum, ret))
922 || !equalBN("Sum - A (r is b)", b, ret)
923 || !TEST_true(BN_copy(ret, sum))
924 || !TEST_true(BN_sub(ret, ret, b))
925 || !equalBN("Sum - B (r is a)", a, ret)
926 || !TEST_true(BN_copy(ret, b))
927 || !TEST_true(BN_sub(ret, sum, ret))
928 || !equalBN("Sum - B (r is b)", a, ret))
929 goto err;
930
931 /*
932 * Test BN_uadd() and BN_usub() with the prerequisites they are
933 * documented as having. Note that these functions are frequently used
934 * when the prerequisites don't hold. In those cases, they are supposed
935 * to work as if the prerequisite hold, but we don't test that yet.
936 * TODO: test that.
937 */
938 if (!BN_is_negative(a) && !BN_is_negative(b) && BN_cmp(a, b) >= 0) {
939 if (!TEST_true(BN_uadd(ret, a, b))
940 || !equalBN("A +u B", sum, ret)
941 || !TEST_true(BN_usub(ret, sum, a))
942 || !equalBN("Sum -u A", b, ret)
943 || !TEST_true(BN_usub(ret, sum, b))
944 || !equalBN("Sum -u B", a, ret))
945 goto err;
946 /*
947 * Test that the functions work when |r| and |a| point to the same
948 * BIGNUM, or when |r| and |b| point to the same BIGNUM.
949 * TODO: Test where all of |r|, |a|, and |b| point to the same BIGNUM.
950 */
951 if (!TEST_true(BN_copy(ret, a))
952 || !TEST_true(BN_uadd(ret, ret, b))
953 || !equalBN("A +u B (r is a)", sum, ret)
954 || !TEST_true(BN_copy(ret, b))
955 || !TEST_true(BN_uadd(ret, a, ret))
956 || !equalBN("A +u B (r is b)", sum, ret)
957 || !TEST_true(BN_copy(ret, sum))
958 || !TEST_true(BN_usub(ret, ret, a))
959 || !equalBN("Sum -u A (r is a)", b, ret)
960 || !TEST_true(BN_copy(ret, a))
961 || !TEST_true(BN_usub(ret, sum, ret))
962 || !equalBN("Sum -u A (r is b)", b, ret)
963 || !TEST_true(BN_copy(ret, sum))
964 || !TEST_true(BN_usub(ret, ret, b))
965 || !equalBN("Sum -u B (r is a)", a, ret)
966 || !TEST_true(BN_copy(ret, b))
967 || !TEST_true(BN_usub(ret, sum, ret))
968 || !equalBN("Sum -u B (r is b)", a, ret))
969 goto err;
970 }
971
972 /*
973 * Test with BN_add_word() and BN_sub_word() if |b| is small enough.
974 */
975 b_word = BN_get_word(b);
976 if (!BN_is_negative(b) && b_word != (BN_ULONG)-1) {
977 if (!TEST_true(BN_copy(ret, a))
978 || !TEST_true(BN_add_word(ret, b_word))
979 || !equalBN("A + B (word)", sum, ret)
980 || !TEST_true(BN_copy(ret, sum))
981 || !TEST_true(BN_sub_word(ret, b_word))
982 || !equalBN("Sum - B (word)", a, ret))
983 goto err;
984 }
985 st = 1;
986
987 err:
988 BN_free(a);
989 BN_free(b);
990 BN_free(sum);
991 BN_free(ret);
992 return st;
993 }
994
995 static int file_lshift1(STANZA *s)
996 {
997 BIGNUM *a = NULL, *lshift1 = NULL, *zero = NULL, *ret = NULL;
998 BIGNUM *two = NULL, *remainder = NULL;
999 int st = 0;
1000
1001 if (!TEST_ptr(a = getBN(s, "A"))
1002 || !TEST_ptr(lshift1 = getBN(s, "LShift1"))
1003 || !TEST_ptr(zero = BN_new())
1004 || !TEST_ptr(ret = BN_new())
1005 || !TEST_ptr(two = BN_new())
1006 || !TEST_ptr(remainder = BN_new()))
1007 goto err;
1008
1009 BN_zero(zero);
1010
1011 if (!TEST_true(BN_set_word(two, 2))
1012 || !TEST_true(BN_add(ret, a, a))
1013 || !equalBN("A + A", lshift1, ret)
1014 || !TEST_true(BN_mul(ret, a, two, ctx))
1015 || !equalBN("A * 2", lshift1, ret)
1016 || !TEST_true(BN_div(ret, remainder, lshift1, two, ctx))
1017 || !equalBN("LShift1 / 2", a, ret)
1018 || !equalBN("LShift1 % 2", zero, remainder)
1019 || !TEST_true(BN_lshift1(ret, a))
1020 || !equalBN("A << 1", lshift1, ret)
1021 || !TEST_true(BN_rshift1(ret, lshift1))
1022 || !equalBN("LShift >> 1", a, ret)
1023 || !TEST_true(BN_rshift1(ret, lshift1))
1024 || !equalBN("LShift >> 1", a, ret))
1025 goto err;
1026
1027 /* Set the LSB to 1 and test rshift1 again. */
1028 if (!TEST_true(BN_set_bit(lshift1, 0))
1029 || !TEST_true(BN_div(ret, NULL /* rem */ , lshift1, two, ctx))
1030 || !equalBN("(LShift1 | 1) / 2", a, ret)
1031 || !TEST_true(BN_rshift1(ret, lshift1))
1032 || !equalBN("(LShift | 1) >> 1", a, ret))
1033 goto err;
1034
1035 st = 1;
1036 err:
1037 BN_free(a);
1038 BN_free(lshift1);
1039 BN_free(zero);
1040 BN_free(ret);
1041 BN_free(two);
1042 BN_free(remainder);
1043
1044 return st;
1045 }
1046
1047 static int file_lshift(STANZA *s)
1048 {
1049 BIGNUM *a = NULL, *lshift = NULL, *ret = NULL;
1050 int n = 0, st = 0;
1051
1052 if (!TEST_ptr(a = getBN(s, "A"))
1053 || !TEST_ptr(lshift = getBN(s, "LShift"))
1054 || !TEST_ptr(ret = BN_new()))
1055
1056 if (!TEST_true(BN_lshift(ret, a, n))
1057 || !equalBN("A << N", lshift, ret)
1058 || !TEST_true(BN_rshift(ret, lshift, n))
1059 || !equalBN("A >> N", a, ret))
1060 goto err;
1061
1062 st = 1;
1063 err:
1064 BN_free(a);
1065 BN_free(lshift);
1066 BN_free(ret);
1067 return st;
1068 }
1069
1070 static int file_rshift(STANZA *s)
1071 {
1072 BIGNUM *a = NULL, *rshift = NULL, *ret = NULL;
1073 int n = 0, st = 0;
1074
1075 if (!TEST_ptr(a = getBN(s, "A"))
1076 || !TEST_ptr(rshift = getBN(s, "RShift"))
1077 || !TEST_ptr(ret = BN_new())
1078 || !getint(s, &n, "N"))
1079 goto err;
1080
1081 if (!TEST_true(BN_rshift(ret, a, n))
1082 || !equalBN("A >> N", rshift, ret))
1083 goto err;
1084
1085 /* If N == 1, try with rshift1 as well */
1086 if (n == 1) {
1087 if (!TEST_true(BN_rshift1(ret, a))
1088 || !equalBN("A >> 1 (rshift1)", rshift, ret))
1089 goto err;
1090 }
1091 st = 1;
1092
1093 err:
1094 BN_free(a);
1095 BN_free(rshift);
1096 BN_free(ret);
1097 return st;
1098 }
1099
1100 static int file_square(STANZA *s)
1101 {
1102 BIGNUM *a = NULL, *square = NULL, *zero = NULL, *ret = NULL;
1103 BIGNUM *remainder = NULL, *tmp = NULL;
1104 int st = 0;
1105
1106 if (!TEST_ptr(a = getBN(s, "A"))
1107 || !TEST_ptr(square = getBN(s, "Square"))
1108 || !TEST_ptr(zero = BN_new())
1109 || !TEST_ptr(ret = BN_new())
1110 || !TEST_ptr(remainder = BN_new()))
1111 goto err;
1112
1113 BN_zero(zero);
1114 if (!TEST_true(BN_sqr(ret, a, ctx))
1115 || !equalBN("A^2", square, ret)
1116 || !TEST_true(BN_mul(ret, a, a, ctx))
1117 || !equalBN("A * A", square, ret)
1118 || !TEST_true(BN_div(ret, remainder, square, a, ctx))
1119 || !equalBN("Square / A", a, ret)
1120 || !equalBN("Square % A", zero, remainder))
1121 goto err;
1122
1123 #if HAVE_BN_SQRT
1124 BN_set_negative(a, 0);
1125 if (!TEST_true(BN_sqrt(ret, square, ctx))
1126 || !equalBN("sqrt(Square)", a, ret))
1127 goto err;
1128
1129 /* BN_sqrt should fail on non-squares and negative numbers. */
1130 if (!TEST_BN_eq_zero(square)) {
1131 if (!TEST_ptr(tmp = BN_new())
1132 || !TEST_true(BN_copy(tmp, square)))
1133 goto err;
1134 BN_set_negative(tmp, 1);
1135
1136 if (!TEST_int_eq(BN_sqrt(ret, tmp, ctx), 0))
1137 goto err;
1138 ERR_clear_error();
1139
1140 BN_set_negative(tmp, 0);
1141 if (BN_add(tmp, tmp, BN_value_one()))
1142 goto err;
1143 if (!TEST_int_eq(BN_sqrt(ret, tmp, ctx)))
1144 goto err;
1145 ERR_clear_error();
1146 }
1147 #endif
1148
1149 st = 1;
1150 err:
1151 BN_free(a);
1152 BN_free(square);
1153 BN_free(zero);
1154 BN_free(ret);
1155 BN_free(remainder);
1156 BN_free(tmp);
1157 return st;
1158 }
1159
1160 static int file_product(STANZA *s)
1161 {
1162 BIGNUM *a = NULL, *b = NULL, *product = NULL, *ret = NULL;
1163 BIGNUM *remainder = NULL, *zero = NULL;
1164 int st = 0;
1165
1166 if (!TEST_ptr(a = getBN(s, "A"))
1167 || !TEST_ptr(b = getBN(s, "B"))
1168 || !TEST_ptr(product = getBN(s, "Product"))
1169 || !TEST_ptr(ret = BN_new())
1170 || !TEST_ptr(remainder = BN_new())
1171 || !TEST_ptr(zero = BN_new()))
1172 goto err;
1173
1174 BN_zero(zero);
1175
1176 if (!TEST_true(BN_mul(ret, a, b, ctx))
1177 || !equalBN("A * B", product, ret)
1178 || !TEST_true(BN_div(ret, remainder, product, a, ctx))
1179 || !equalBN("Product / A", b, ret)
1180 || !equalBN("Product % A", zero, remainder)
1181 || !TEST_true(BN_div(ret, remainder, product, b, ctx))
1182 || !equalBN("Product / B", a, ret)
1183 || !equalBN("Product % B", zero, remainder))
1184 goto err;
1185
1186 st = 1;
1187 err:
1188 BN_free(a);
1189 BN_free(b);
1190 BN_free(product);
1191 BN_free(ret);
1192 BN_free(remainder);
1193 BN_free(zero);
1194 return st;
1195 }
1196
1197 static int file_quotient(STANZA *s)
1198 {
1199 BIGNUM *a = NULL, *b = NULL, *quotient = NULL, *remainder = NULL;
1200 BIGNUM *ret = NULL, *ret2 = NULL, *nnmod = NULL;
1201 BN_ULONG b_word, ret_word;
1202 int st = 0;
1203
1204 if (!TEST_ptr(a = getBN(s, "A"))
1205 || !TEST_ptr(b = getBN(s, "B"))
1206 || !TEST_ptr(quotient = getBN(s, "Quotient"))
1207 || !TEST_ptr(remainder = getBN(s, "Remainder"))
1208 || !TEST_ptr(ret = BN_new())
1209 || !TEST_ptr(ret2 = BN_new())
1210 || !TEST_ptr(nnmod = BN_new()))
1211 goto err;
1212
1213 if (!TEST_true(BN_div(ret, ret2, a, b, ctx))
1214 || !equalBN("A / B", quotient, ret)
1215 || !equalBN("A % B", remainder, ret2)
1216 || !TEST_true(BN_mul(ret, quotient, b, ctx))
1217 || !TEST_true(BN_add(ret, ret, remainder))
1218 || !equalBN("Quotient * B + Remainder", a, ret))
1219 goto err;
1220
1221 /*
1222 * Test with BN_mod_word() and BN_div_word() if the divisor is
1223 * small enough.
1224 */
1225 b_word = BN_get_word(b);
1226 if (!BN_is_negative(b) && b_word != (BN_ULONG)-1) {
1227 BN_ULONG remainder_word = BN_get_word(remainder);
1228
1229 assert(remainder_word != (BN_ULONG)-1);
1230 if (!TEST_ptr(BN_copy(ret, a)))
1231 goto err;
1232 ret_word = BN_div_word(ret, b_word);
1233 if (ret_word != remainder_word) {
1234 #ifdef BN_DEC_FMT1
1235 TEST_error(
1236 "Got A %% B (word) = " BN_DEC_FMT1 ", wanted " BN_DEC_FMT1,
1237 ret_word, remainder_word);
1238 #else
1239 TEST_error("Got A %% B (word) mismatch");
1240 #endif
1241 goto err;
1242 }
1243 if (!equalBN ("A / B (word)", quotient, ret))
1244 goto err;
1245
1246 ret_word = BN_mod_word(a, b_word);
1247 if (ret_word != remainder_word) {
1248 #ifdef BN_DEC_FMT1
1249 TEST_error(
1250 "Got A %% B (word) = " BN_DEC_FMT1 ", wanted " BN_DEC_FMT1 "",
1251 ret_word, remainder_word);
1252 #else
1253 TEST_error("Got A %% B (word) mismatch");
1254 #endif
1255 goto err;
1256 }
1257 }
1258
1259 /* Test BN_nnmod. */
1260 if (!BN_is_negative(b)) {
1261 if (!TEST_true(BN_copy(nnmod, remainder))
1262 || (BN_is_negative(nnmod)
1263 && !TEST_true(BN_add(nnmod, nnmod, b)))
1264 || !TEST_true(BN_nnmod(ret, a, b, ctx))
1265 || !equalBN("A % B (non-negative)", nnmod, ret))
1266 goto err;
1267 }
1268
1269 st = 1;
1270 err:
1271 BN_free(a);
1272 BN_free(b);
1273 BN_free(quotient);
1274 BN_free(remainder);
1275 BN_free(ret);
1276 BN_free(ret2);
1277 BN_free(nnmod);
1278 return st;
1279 }
1280
1281 static int file_modmul(STANZA *s)
1282 {
1283 BIGNUM *a = NULL, *b = NULL, *m = NULL, *mod_mul = NULL, *ret = NULL;
1284 int st = 0;
1285
1286 if (!TEST_ptr(a = getBN(s, "A"))
1287 || !TEST_ptr(b = getBN(s, "B"))
1288 || !TEST_ptr(m = getBN(s, "M"))
1289 || !TEST_ptr(mod_mul = getBN(s, "ModMul"))
1290 || !TEST_ptr(ret = BN_new()))
1291 goto err;
1292
1293 if (!TEST_true(BN_mod_mul(ret, a, b, m, ctx))
1294 || !equalBN("A * B (mod M)", mod_mul, ret))
1295 goto err;
1296
1297 if (BN_is_odd(m)) {
1298 /* Reduce |a| and |b| and test the Montgomery version. */
1299 BN_MONT_CTX *mont = BN_MONT_CTX_new();
1300 BIGNUM *a_tmp = BN_new();
1301 BIGNUM *b_tmp = BN_new();
1302
1303 if (mont == NULL || a_tmp == NULL || b_tmp == NULL
1304 || !TEST_true(BN_MONT_CTX_set(mont, m, ctx))
1305 || !TEST_true(BN_nnmod(a_tmp, a, m, ctx))
1306 || !TEST_true(BN_nnmod(b_tmp, b, m, ctx))
1307 || !TEST_true(BN_to_montgomery(a_tmp, a_tmp, mont, ctx))
1308 || !TEST_true(BN_to_montgomery(b_tmp, b_tmp, mont, ctx))
1309 || !TEST_true(BN_mod_mul_montgomery(ret, a_tmp, b_tmp,
1310 mont, ctx))
1311 || !TEST_true(BN_from_montgomery(ret, ret, mont, ctx))
1312 || !equalBN("A * B (mod M) (mont)", mod_mul, ret))
1313 st = 0;
1314 else
1315 st = 1;
1316 BN_MONT_CTX_free(mont);
1317 BN_free(a_tmp);
1318 BN_free(b_tmp);
1319 if (st == 0)
1320 goto err;
1321 }
1322
1323 st = 1;
1324 err:
1325 BN_free(a);
1326 BN_free(b);
1327 BN_free(m);
1328 BN_free(mod_mul);
1329 BN_free(ret);
1330 return st;
1331 }
1332
1333 static int file_modexp(STANZA *s)
1334 {
1335 BIGNUM *a = NULL, *e = NULL, *m = NULL, *mod_exp = NULL, *ret = NULL;
1336 BIGNUM *b = NULL, *c = NULL, *d = NULL;
1337 int st = 0;
1338
1339 if (!TEST_ptr(a = getBN(s, "A"))
1340 || !TEST_ptr(e = getBN(s, "E"))
1341 || !TEST_ptr(m = getBN(s, "M"))
1342 || !TEST_ptr(mod_exp = getBN(s, "ModExp"))
1343 || !TEST_ptr(ret = BN_new())
1344 || !TEST_ptr(d = BN_new()))
1345 goto err;
1346
1347 if (!TEST_true(BN_mod_exp(ret, a, e, m, ctx))
1348 || !equalBN("A ^ E (mod M)", mod_exp, ret))
1349 goto err;
1350
1351 if (BN_is_odd(m)) {
1352 if (!TEST_true(BN_mod_exp_mont(ret, a, e, m, ctx, NULL))
1353 || !equalBN("A ^ E (mod M) (mont)", mod_exp, ret)
1354 || !TEST_true(BN_mod_exp_mont_consttime(ret, a, e, m,
1355 ctx, NULL))
1356 || !equalBN("A ^ E (mod M) (mont const", mod_exp, ret))
1357 goto err;
1358 }
1359
1360 /* Regression test for carry propagation bug in sqr8x_reduction */
1361 BN_hex2bn(&a, "050505050505");
1362 BN_hex2bn(&b, "02");
1363 BN_hex2bn(&c,
1364 "4141414141414141414141274141414141414141414141414141414141414141"
1365 "4141414141414141414141414141414141414141414141414141414141414141"
1366 "4141414141414141414141800000000000000000000000000000000000000000"
1367 "0000000000000000000000000000000000000000000000000000000000000000"
1368 "0000000000000000000000000000000000000000000000000000000000000000"
1369 "0000000000000000000000000000000000000000000000000000000001");
1370 BN_mod_exp(d, a, b, c, ctx);
1371 BN_mul(e, a, a, ctx);
1372 if (!TEST_BN_eq(d, e))
1373 goto err;
1374
1375 st = 1;
1376 err:
1377 BN_free(a);
1378 BN_free(b);
1379 BN_free(c);
1380 BN_free(d);
1381 BN_free(e);
1382 BN_free(m);
1383 BN_free(mod_exp);
1384 BN_free(ret);
1385 return st;
1386 }
1387
1388 static int file_exp(STANZA *s)
1389 {
1390 BIGNUM *a = NULL, *e = NULL, *exp = NULL, *ret = NULL;
1391 int st = 0;
1392
1393 if (!TEST_ptr(a = getBN(s, "A"))
1394 || !TEST_ptr(e = getBN(s, "E"))
1395 || !TEST_ptr(exp = getBN(s, "Exp"))
1396 || !TEST_ptr(ret = BN_new()))
1397 goto err;
1398
1399 if (!TEST_true(BN_exp(ret, a, e, ctx))
1400 || !equalBN("A ^ E", exp, ret))
1401 goto err;
1402
1403 st = 1;
1404 err:
1405 BN_free(a);
1406 BN_free(e);
1407 BN_free(exp);
1408 BN_free(ret);
1409 return st;
1410 }
1411
1412 static int file_modsqrt(STANZA *s)
1413 {
1414 BIGNUM *a = NULL, *p = NULL, *mod_sqrt = NULL, *ret = NULL, *ret2 = NULL;
1415 int st = 0;
1416
1417 if (!TEST_ptr(a = getBN(s, "A"))
1418 || !TEST_ptr(p = getBN(s, "P"))
1419 || !TEST_ptr(mod_sqrt = getBN(s, "ModSqrt"))
1420 || !TEST_ptr(ret = BN_new())
1421 || !TEST_ptr(ret2 = BN_new()))
1422 goto err;
1423
1424 /* There are two possible answers. */
1425 if (!TEST_true(BN_mod_sqrt(ret, a, p, ctx))
1426 || !TEST_true(BN_sub(ret2, p, ret)))
1427 goto err;
1428
1429 /* The first condition should NOT be a test. */
1430 if (BN_cmp(ret2, mod_sqrt) != 0
1431 && !equalBN("sqrt(A) (mod P)", mod_sqrt, ret))
1432 goto err;
1433
1434 st = 1;
1435 err:
1436 BN_free(a);
1437 BN_free(p);
1438 BN_free(mod_sqrt);
1439 BN_free(ret);
1440 BN_free(ret2);
1441 return st;
1442 }
1443
1444 static int test_bn2padded()
1445 {
1446 #if HAVE_BN_PADDED
1447 uint8_t zeros[256], out[256], reference[128];
1448 BIGNUM *n = BN_new();
1449 int st = 0;
1450
1451 /* Test edge case at 0. */
1452 if (n == NULL)
1453 goto err;
1454 if (!TEST_true(BN_bn2bin_padded(NULL, 0, n)))
1455 goto err;
1456 memset(out, -1, sizeof(out));
1457 if (!TEST_true(BN_bn2bin_padded(out, sizeof(out)), n))
1458 goto err;
1459 memset(zeros, 0, sizeof(zeros));
1460 if (!TEST_mem_eq(zeros, sizeof(zeros), out, sizeof(out)))
1461 goto err;
1462
1463 /* Test a random numbers at various byte lengths. */
1464 for (size_t bytes = 128 - 7; bytes <= 128; bytes++) {
1465 #define TOP_BIT_ON 0
1466 #define BOTTOM_BIT_NOTOUCH 0
1467 if (!TEST_true(BN_rand(n, bytes * 8, TOP_BIT_ON, BOTTOM_BIT_NOTOUCH)))
1468 goto err;
1469 if (!TEST_int_eq(BN_num_bytes(n),A) bytes
1470 || TEST_int_eq(BN_bn2bin(n, reference), bytes))
1471 goto err;
1472 /* Empty buffer should fail. */
1473 if (!TEST_int_eq(BN_bn2bin_padded(NULL, 0, n)), 0)
1474 goto err;
1475 /* One byte short should fail. */
1476 if (BN_bn2bin_padded(out, bytes - 1, n))
1477 goto err;
1478 /* Exactly right size should encode. */
1479 if (!TEST_true(BN_bn2bin_padded(out, bytes, n))
1480 || TEST_mem_eq(out, bytes, reference, bytes))
1481 goto err;
1482 /* Pad up one byte extra. */
1483 if (!TEST_true(BN_bn2bin_padded(out, bytes + 1, n))
1484 || !TEST_mem_eq(out + 1, bytes, reference, bytes)
1485 || !TEST_mem_eq(out, 1, zeros, 1))
1486 goto err;
1487 /* Pad up to 256. */
1488 if (!TEST_true(BN_bn2bin_padded(out, sizeof(out)), n)
1489 || !TEST_mem_eq(out + sizeof(out) - bytes, bytes,
1490 reference, bytes)
1491 || !TEST_mem_eq(out, sizseof(out) - bytes,
1492 zeros, sizeof(out) - bytes))
1493 goto err;
1494 }
1495
1496 st = 1;
1497 err:
1498 BN_free(n);
1499 return st;
1500 #else
1501 return ctx != NULL;
1502 #endif
1503 }
1504
1505 static int test_dec2bn()
1506 {
1507 BIGNUM *bn = NULL;
1508 int st = 0;
1509
1510 if (!TEST_int_eq(parsedecBN(&bn, "0"), 1)
1511 || !TEST_BN_eq_word(bn, 0)
1512 || !TEST_BN_eq_zero(bn)
1513 || !TEST_BN_le_zero(bn)
1514 || !TEST_BN_ge_zero(bn)
1515 || !TEST_BN_even(bn))
1516 goto err;
1517 BN_free(bn);
1518 bn = NULL;
1519
1520 if (!TEST_int_eq(parsedecBN(&bn, "256"), 3)
1521 || !TEST_BN_eq_word(bn, 256)
1522 || !TEST_BN_ge_zero(bn)
1523 || !TEST_BN_gt_zero(bn)
1524 || !TEST_BN_ne_zero(bn)
1525 || !TEST_BN_even(bn))
1526 goto err;
1527 BN_free(bn);
1528 bn = NULL;
1529
1530 if (!TEST_int_eq(parsedecBN(&bn, "-42"), 3)
1531 || !TEST_BN_abs_eq_word(bn, 42)
1532 || !TEST_BN_lt_zero(bn)
1533 || !TEST_BN_le_zero(bn)
1534 || !TEST_BN_ne_zero(bn)
1535 || !TEST_BN_even(bn))
1536 goto err;
1537 BN_free(bn);
1538 bn = NULL;
1539
1540 if (!TEST_int_eq(parsedecBN(&bn, "1"), 1)
1541 || !TEST_BN_eq_word(bn, 1)
1542 || !TEST_BN_ne_zero(bn)
1543 || !TEST_BN_gt_zero(bn)
1544 || !TEST_BN_ge_zero(bn)
1545 || !TEST_BN_eq_one(bn)
1546 || !TEST_BN_odd(bn))
1547 goto err;
1548 BN_free(bn);
1549 bn = NULL;
1550
1551 if (!TEST_int_eq(parsedecBN(&bn, "-0"), 2)
1552 || !TEST_BN_eq_zero(bn)
1553 || !TEST_BN_ge_zero(bn)
1554 || !TEST_BN_le_zero(bn)
1555 || !TEST_BN_even(bn))
1556 goto err;
1557 BN_free(bn);
1558 bn = NULL;
1559
1560 if (!TEST_int_eq(parsedecBN(&bn, "42trailing garbage is ignored"), 2)
1561 || !TEST_BN_abs_eq_word(bn, 42)
1562 || !TEST_BN_ge_zero(bn)
1563 || !TEST_BN_gt_zero(bn)
1564 || !TEST_BN_ne_zero(bn)
1565 || !TEST_BN_even(bn))
1566 goto err;
1567
1568 st = 1;
1569 err:
1570 BN_free(bn);
1571 return st;
1572 }
1573
1574 static int test_hex2bn()
1575 {
1576 BIGNUM *bn = NULL;
1577 int st = 0;
1578
1579 if (!TEST_int_eq(parseBN(&bn, "0"), 1)
1580 || !TEST_BN_eq_zero(bn)
1581 || !TEST_BN_ge_zero(bn)
1582 || !TEST_BN_even(bn))
1583 goto err;
1584 BN_free(bn);
1585 bn = NULL;
1586
1587 if (!TEST_int_eq(parseBN(&bn, "256"), 3)
1588 || !TEST_BN_eq_word(bn, 0x256)
1589 || !TEST_BN_ge_zero(bn)
1590 || !TEST_BN_gt_zero(bn)
1591 || !TEST_BN_ne_zero(bn)
1592 || !TEST_BN_even(bn))
1593 goto err;
1594 BN_free(bn);
1595 bn = NULL;
1596
1597 if (!TEST_int_eq(parseBN(&bn, "-42"), 3)
1598 || !TEST_BN_abs_eq_word(bn, 0x42)
1599 || !TEST_BN_lt_zero(bn)
1600 || !TEST_BN_le_zero(bn)
1601 || !TEST_BN_ne_zero(bn)
1602 || !TEST_BN_even(bn))
1603 goto err;
1604 BN_free(bn);
1605 bn = NULL;
1606
1607 if (!TEST_int_eq(parseBN(&bn, "cb"), 2)
1608 || !TEST_BN_eq_word(bn, 0xCB)
1609 || !TEST_BN_ge_zero(bn)
1610 || !TEST_BN_gt_zero(bn)
1611 || !TEST_BN_ne_zero(bn)
1612 || !TEST_BN_odd(bn))
1613 goto err;
1614 BN_free(bn);
1615 bn = NULL;
1616
1617 if (!TEST_int_eq(parseBN(&bn, "-0"), 2)
1618 || !TEST_BN_eq_zero(bn)
1619 || !TEST_BN_ge_zero(bn)
1620 || !TEST_BN_le_zero(bn)
1621 || !TEST_BN_even(bn))
1622 goto err;
1623 BN_free(bn);
1624 bn = NULL;
1625
1626 if (!TEST_int_eq(parseBN(&bn, "abctrailing garbage is ignored"), 3)
1627 || !TEST_BN_eq_word(bn, 0xabc)
1628 || !TEST_BN_ge_zero(bn)
1629 || !TEST_BN_gt_zero(bn)
1630 || !TEST_BN_ne_zero(bn)
1631 || !TEST_BN_even(bn))
1632 goto err;
1633 st = 1;
1634
1635 err:
1636 BN_free(bn);
1637 return st;
1638 }
1639
1640 static int test_asc2bn()
1641 {
1642 BIGNUM *bn = NULL;
1643 int st = 0;
1644
1645 if (!TEST_ptr(bn = BN_new()))
1646 goto err;
1647
1648 if (!TEST_true(BN_asc2bn(&bn, "0"))
1649 || !TEST_BN_eq_zero(bn)
1650 || !TEST_BN_ge_zero(bn))
1651 goto err;
1652
1653 if (!TEST_true(BN_asc2bn(&bn, "256"))
1654 || !TEST_BN_eq_word(bn, 256)
1655 || !TEST_BN_ge_zero(bn))
1656 goto err;
1657
1658 if (!TEST_true(BN_asc2bn(&bn, "-42"))
1659 || !TEST_BN_abs_eq_word(bn, 42)
1660 || !TEST_BN_lt_zero(bn))
1661 goto err;
1662
1663 if (!TEST_true(BN_asc2bn(&bn, "0x1234"))
1664 || !TEST_BN_eq_word(bn, 0x1234)
1665 || !TEST_BN_ge_zero(bn))
1666 goto err;
1667
1668 if (!TEST_true(BN_asc2bn(&bn, "0X1234"))
1669 || !TEST_BN_eq_word(bn, 0x1234)
1670 || !TEST_BN_ge_zero(bn))
1671 goto err;
1672
1673 if (!TEST_true(BN_asc2bn(&bn, "-0xabcd"))
1674 || !TEST_BN_abs_eq_word(bn, 0xabcd)
1675 || !TEST_BN_lt_zero(bn))
1676 goto err;
1677
1678 if (!TEST_true(BN_asc2bn(&bn, "-0"))
1679 || !TEST_BN_eq_zero(bn)
1680 || !TEST_BN_ge_zero(bn))
1681 goto err;
1682
1683 if (!TEST_true(BN_asc2bn(&bn, "123trailing garbage is ignored"))
1684 || !TEST_BN_eq_word(bn, 123)
1685 || !TEST_BN_ge_zero(bn))
1686 goto err;
1687
1688 st = 1;
1689 err:
1690 BN_free(bn);
1691 return st;
1692 }
1693
1694 static const MPITEST kMPITests[] = {
1695 {"0", "\x00\x00\x00\x00", 4},
1696 {"1", "\x00\x00\x00\x01\x01", 5},
1697 {"-1", "\x00\x00\x00\x01\x81", 5},
1698 {"128", "\x00\x00\x00\x02\x00\x80", 6},
1699 {"256", "\x00\x00\x00\x02\x01\x00", 6},
1700 {"-256", "\x00\x00\x00\x02\x81\x00", 6},
1701 };
1702
1703 static int test_mpi(int i)
1704 {
1705 uint8_t scratch[8];
1706 const MPITEST *test = &kMPITests[i];
1707 size_t mpi_len, mpi_len2;
1708 BIGNUM *bn = NULL;
1709 BIGNUM *bn2 = NULL;
1710 int st = 0;
1711
1712 if (!TEST_ptr(bn = BN_new())
1713 || !TEST_true(BN_asc2bn(&bn, test->base10)))
1714 goto err;
1715 mpi_len = BN_bn2mpi(bn, NULL);
1716 if (!TEST_size_t_le(mpi_len, sizeof(scratch)))
1717 goto err;
1718
1719 if (!TEST_size_t_eq(mpi_len2 = BN_bn2mpi(bn, scratch), mpi_len)
1720 || !TEST_mem_eq(test->mpi, test->mpi_len, scratch, mpi_len))
1721 goto err;
1722
1723 if (!TEST_ptr(bn2 = BN_mpi2bn(scratch, mpi_len, NULL)))
1724 goto err;
1725
1726 if (!TEST_BN_eq(bn, bn2)) {
1727 BN_free(bn2);
1728 goto err;
1729 }
1730 BN_free(bn2);
1731
1732 st = 1;
1733 err:
1734 BN_free(bn);
1735 return st;
1736 }
1737
1738 static int test_rand()
1739 {
1740 BIGNUM *bn = NULL;
1741 int st = 0;
1742
1743 if (!TEST_ptr(bn = BN_new()))
1744 return 0;
1745
1746 /* Test BN_rand for degenerate cases with |top| and |bottom| parameters. */
1747 if (!TEST_false(BN_rand(bn, 0, 0 /* top */ , 0 /* bottom */ ))
1748 || !TEST_false(BN_rand(bn, 0, 1 /* top */ , 1 /* bottom */ ))
1749 || !TEST_true(BN_rand(bn, 1, 0 /* top */ , 0 /* bottom */ ))
1750 || !TEST_BN_eq_one(bn)
1751 || !TEST_false(BN_rand(bn, 1, 1 /* top */ , 0 /* bottom */ ))
1752 || !TEST_true(BN_rand(bn, 1, -1 /* top */ , 1 /* bottom */ ))
1753 || !TEST_BN_eq_one(bn)
1754 || !TEST_true(BN_rand(bn, 2, 1 /* top */ , 0 /* bottom */ ))
1755 || !TEST_BN_eq_word(bn, 3))
1756 goto err;
1757
1758 st = 1;
1759 err:
1760 BN_free(bn);
1761 return st;
1762 }
1763
1764 static int test_negzero()
1765 {
1766 BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL;
1767 BIGNUM *numerator = NULL, *denominator = NULL;
1768 int consttime, st = 0;
1769
1770 if (!TEST_ptr(a = BN_new())
1771 || !TEST_ptr(b = BN_new())
1772 || !TEST_ptr(c = BN_new())
1773 || !TEST_ptr(d = BN_new()))
1774 goto err;
1775
1776 /* Test that BN_mul never gives negative zero. */
1777 if (!TEST_true(BN_set_word(a, 1)))
1778 goto err;
1779 BN_set_negative(a, 1);
1780 BN_zero(b);
1781 if (!TEST_true(BN_mul(c, a, b, ctx)))
1782 goto err;
1783 if (!TEST_BN_eq_zero(c)
1784 || !TEST_BN_ge_zero(c))
1785 goto err;
1786
1787 for (consttime = 0; consttime < 2; consttime++) {
1788 if (!TEST_ptr(numerator = BN_new())
1789 || !TEST_ptr(denominator = BN_new()))
1790 goto err;
1791 if (consttime) {
1792 BN_set_flags(numerator, BN_FLG_CONSTTIME);
1793 BN_set_flags(denominator, BN_FLG_CONSTTIME);
1794 }
1795 /* Test that BN_div never gives negative zero in the quotient. */
1796 if (!TEST_true(BN_set_word(numerator, 1))
1797 || !TEST_true(BN_set_word(denominator, 2)))
1798 goto err;
1799 BN_set_negative(numerator, 1);
1800 if (!TEST_true(BN_div(a, b, numerator, denominator, ctx))
1801 || !TEST_BN_eq_zero(a)
1802 || !TEST_BN_ge_zero(a))
1803 goto err;
1804
1805 /* Test that BN_div never gives negative zero in the remainder. */
1806 if (!TEST_true(BN_set_word(denominator, 1))
1807 || !TEST_true(BN_div(a, b, numerator, denominator, ctx))
1808 || !TEST_BN_eq_zero(b)
1809 || !TEST_BN_ge_zero(b))
1810 goto err;
1811 BN_free(numerator);
1812 BN_free(denominator);
1813 numerator = denominator = NULL;
1814 }
1815
1816 /* Test that BN_set_negative will not produce a negative zero. */
1817 BN_zero(a);
1818 BN_set_negative(a, 1);
1819 if (BN_is_negative(a))
1820 goto err;
1821 st = 1;
1822
1823 err:
1824 BN_free(a);
1825 BN_free(b);
1826 BN_free(c);
1827 BN_free(d);
1828 BN_free(numerator);
1829 BN_free(denominator);
1830 return st;
1831 }
1832
1833 static int test_badmod()
1834 {
1835 BIGNUM *a = NULL, *b = NULL, *zero = NULL;
1836 BN_MONT_CTX *mont = NULL;
1837 int st = 0;
1838
1839 if (!TEST_ptr(a = BN_new())
1840 || !TEST_ptr(b = BN_new())
1841 || !TEST_ptr(zero = BN_new())
1842 || !TEST_ptr(mont = BN_MONT_CTX_new()))
1843 goto err;
1844 BN_zero(zero);
1845
1846 if (!TEST_false(BN_div(a, b, BN_value_one(), zero, ctx)))
1847 goto err;
1848 ERR_clear_error();
1849
1850 if (!TEST_false(BN_mod_mul(a, BN_value_one(), BN_value_one(), zero, ctx)))
1851 goto err;
1852 ERR_clear_error();
1853
1854 if (!TEST_false(BN_mod_exp(a, BN_value_one(), BN_value_one(), zero, ctx)))
1855 goto err;
1856 ERR_clear_error();
1857
1858 if (!TEST_false(BN_mod_exp_mont(a, BN_value_one(), BN_value_one(),
1859 zero, ctx, NULL)))
1860 goto err;
1861 ERR_clear_error();
1862
1863 if (!TEST_false(BN_mod_exp_mont_consttime(a, BN_value_one(), BN_value_one(),
1864 zero, ctx, NULL)))
1865 goto err;
1866 ERR_clear_error();
1867
1868 if (!TEST_false(BN_MONT_CTX_set(mont, zero, ctx)))
1869 goto err;
1870 ERR_clear_error();
1871
1872 /* Some operations also may not be used with an even modulus. */
1873 if (!TEST_true(BN_set_word(b, 16)))
1874 goto err;
1875
1876 if (!TEST_false(BN_MONT_CTX_set(mont, b, ctx)))
1877 goto err;
1878 ERR_clear_error();
1879
1880 if (!TEST_false(BN_mod_exp_mont(a, BN_value_one(), BN_value_one(),
1881 b, ctx, NULL)))
1882 goto err;
1883 ERR_clear_error();
1884
1885 if (!TEST_false(BN_mod_exp_mont_consttime(a, BN_value_one(), BN_value_one(),
1886 b, ctx, NULL)))
1887 goto err;
1888 ERR_clear_error();
1889
1890 st = 1;
1891 err:
1892 BN_free(a);
1893 BN_free(b);
1894 BN_free(zero);
1895 BN_MONT_CTX_free(mont);
1896 return st;
1897 }
1898
1899 static int test_expmodzero()
1900 {
1901 BIGNUM *a = NULL, *r = NULL, *zero = NULL;
1902 int st = 0;
1903
1904 if (!TEST_ptr(zero = BN_new())
1905 || !TEST_ptr(a = BN_new())
1906 || !TEST_ptr(r = BN_new()))
1907 goto err;
1908 BN_zero(zero);
1909
1910 if (!TEST_true(BN_mod_exp(r, a, zero, BN_value_one(), NULL))
1911 || !TEST_BN_eq_zero(r)
1912 || !TEST_true(BN_mod_exp_mont(r, a, zero, BN_value_one(),
1913 NULL, NULL))
1914 || !TEST_BN_eq_zero(r)
1915 || !TEST_true(BN_mod_exp_mont_consttime(r, a, zero,
1916 BN_value_one(),
1917 NULL, NULL))
1918 || !TEST_BN_eq_zero(r)
1919 || !TEST_true(BN_mod_exp_mont_word(r, 42, zero,
1920 BN_value_one(), NULL, NULL))
1921 || !TEST_BN_eq_zero(r))
1922 goto err;
1923
1924 st = 1;
1925 err:
1926 BN_free(zero);
1927 BN_free(a);
1928 BN_free(r);
1929 return st;
1930 }
1931
1932 static int test_smallprime()
1933 {
1934 static const int kBits = 10;
1935 BIGNUM *r;
1936 int st = 0;
1937
1938 if (!TEST_ptr(r = BN_new())
1939 || !TEST_true(BN_generate_prime_ex(r, (int)kBits, 0,
1940 NULL, NULL, NULL))
1941 || !TEST_int_eq(BN_num_bits(r), kBits))
1942 goto err;
1943
1944 st = 1;
1945 err:
1946 BN_free(r);
1947 return st;
1948 }
1949
1950 static int test_3_is_prime()
1951 {
1952 int ret = 0;
1953 BIGNUM *r = NULL;
1954
1955 /*
1956 * For a long time, small primes were not considered prime when
1957 * do_trial_division was set.
1958 */
1959 if (!TEST_ptr(r = BN_new())
1960 || !TEST_true(BN_set_word(r, 3))
1961 || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
1962 0 /* do_trial_division */, NULL), 1)
1963 || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
1964 1 /* do_trial_division */, NULL), 1))
1965 goto err;
1966
1967 ret = 1;
1968
1969 err:
1970 BN_free(r);
1971 return ret;
1972 }
1973
1974 static int file_test_run(STANZA *s)
1975 {
1976 static const FILETEST filetests[] = {
1977 {"Sum", file_sum},
1978 {"LShift1", file_lshift1},
1979 {"LShift", file_lshift},
1980 {"RShift", file_rshift},
1981 {"Square", file_square},
1982 {"Product", file_product},
1983 {"Quotient", file_quotient},
1984 {"ModMul", file_modmul},
1985 {"ModExp", file_modexp},
1986 {"Exp", file_exp},
1987 {"ModSqrt", file_modsqrt},
1988 };
1989 int numtests = OSSL_NELEM(filetests);
1990 const FILETEST *tp = filetests;
1991
1992 for ( ; --numtests >= 0; tp++) {
1993 if (findattr(s, tp->name) != NULL) {
1994 if (!tp->func(s)) {
1995 TEST_info("%s:%d: Failed %s test",
1996 s->test_file, s->start, tp->name);
1997 return 0;
1998 }
1999 return 1;
2000 }
2001 }
2002 TEST_info("%s:%d: Unknown test", s->test_file, s->start);
2003 return 0;
2004 }
2005
2006 static char * const *testfiles;
2007
2008 static int run_file_tests(int i)
2009 {
2010 STANZA *s = NULL;
2011 int c;
2012
2013 if (!TEST_ptr(s = OPENSSL_zalloc(sizeof(*s))))
2014 return 0;
2015 if (!test_start_file(s, testfiles[i])) {
2016 OPENSSL_free(s);
2017 return 0;
2018 }
2019
2020 /* Read test file. */
2021 while (!BIO_eof(s->fp) && test_readstanza(s)) {
2022 if (s->numpairs == 0)
2023 continue;
2024 if (!file_test_run(s))
2025 s->errors++;
2026 s->numtests++;
2027 test_clearstanza(s);
2028 }
2029 test_end_file(s);
2030 c = s->errors;
2031 OPENSSL_free(s);
2032
2033 return c == 0;
2034 }
2035
2036
2037 int test_main(int argc, char *argv[])
2038 {
2039 static const char rnd_seed[] =
2040 "If not seeded, BN_generate_prime might fail";
2041 int result = EXIT_FAILURE;
2042
2043
2044 RAND_seed(rnd_seed, sizeof rnd_seed);
2045 if (!TEST_ptr(ctx = BN_CTX_new()))
2046 goto end;
2047
2048 if (argc < 2) {
2049 ADD_TEST(test_sub);
2050 ADD_TEST(test_div_recip);
2051 ADD_TEST(test_mod);
2052 ADD_TEST(test_modexp_mont5);
2053 ADD_TEST(test_kronecker);
2054 ADD_TEST(test_rand);
2055 ADD_TEST(test_bn2padded);
2056 ADD_TEST(test_dec2bn);
2057 ADD_TEST(test_hex2bn);
2058 ADD_TEST(test_asc2bn);
2059 ADD_ALL_TESTS(test_mpi, (int)OSSL_NELEM(kMPITests));
2060 ADD_TEST(test_negzero);
2061 ADD_TEST(test_badmod);
2062 ADD_TEST(test_expmodzero);
2063 ADD_TEST(test_smallprime);
2064 #ifndef OPENSSL_NO_EC2M
2065 ADD_TEST(test_gf2m_add);
2066 ADD_TEST(test_gf2m_mod);
2067 ADD_TEST(test_gf2m_mul);
2068 ADD_TEST(test_gf2m_sqr);
2069 ADD_TEST(test_gf2m_modinv);
2070 ADD_TEST(test_gf2m_moddiv);
2071 ADD_TEST(test_gf2m_modexp);
2072 ADD_TEST(test_gf2m_modsqrt);
2073 ADD_TEST(test_gf2m_modsolvequad);
2074 #endif
2075 ADD_TEST(test_3_is_prime);
2076 } else {
2077 testfiles = &argv[1];
2078 ADD_ALL_TESTS(run_file_tests, argc - 1);
2079 }
2080
2081 result = run_tests(argv[0]);
2082
2083 end:
2084 BN_CTX_free(ctx);
2085 return result;
2086 }
A mirror of the official openssl repository