tree 0cb27e6b35cc1b57c8ecdeddacb2de3f7842e55a
parent 9a5bfc035045db0ba5f3c5b51545917deea7441a
author David Benjamin <davidben@google.com> 1516382021 -0500
committer Adam Langley <agl@google.com> 1517597094 +0000

Reject negative numbers in BN_{mod_mul,to,from}_montgomery.

These functions already require their inputs to be reduced mod N (or, in
some cases, bounded by R or N*R), so negative numbers are nonsense.  The
code still attempted to account for them by working on the absolute
value and fiddling with the sign bit. (The output would be in range (-N,
N) instead of [0, N).)

This complicates relaxing bn_correct_top because bn_correct_top is also
used to prevent storing a negative zero. Instead, just reject negative
inputs.

Upgrade-Note: These functions are public API, so some callers may
    notice. Code search suggests there is only one caller outside
    BoringSSL, and it looks fine.

Bug: 232
Change-Id: Ieba3acbb36b0ff6b72b8ed2b14882ec9b88e4665
Reviewed-on: https://boringssl-review.googlesource.com/25249
Reviewed-by: Adam Langley <agl@google.com>