Deprecate |BN_mod_exp2_mont| and simplify its implementation.
This function is only really useful for DSA signature verification,
which is something that isn't performance-sensitive. Replace its
optimized implementation with a naïve implementation that's much
simpler.
Note that it would be simpler to use |BN_mod_mul| in the new
implementation; |BN_mod_mul_montgomery| is used instead only to be
consistent with other work being done to replace uses of non-Montgomery
modular reduction with Montgomery modular reduction.
Change-Id: If587d463b73dd997acfc5b7ada955398c99cc342
Reviewed-on: https://boringssl-review.googlesource.com/7732
Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/crypto/bn/exponentiation.c b/crypto/bn/exponentiation.c
index 91095e0..219245c 100644
--- a/crypto/bn/exponentiation.c
+++ b/crypto/bn/exponentiation.c
@@ -1252,37 +1252,12 @@
int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
const BIGNUM *a2, const BIGNUM *p2, const BIGNUM *m,
BN_CTX *ctx, const BN_MONT_CTX *mont) {
- int i, j, bits, b, bits1, bits2, ret = 0, wpos1, wpos2, window1, window2,
- wvalue1, wvalue2;
- int r_is_one = 1;
- BIGNUM *d, *r;
- const BIGNUM *a_mod_m;
- /* Tables of variables obtained from 'ctx' */
- BIGNUM *val1[TABLE_SIZE], *val2[TABLE_SIZE];
+ BIGNUM tmp;
+ BN_init(&tmp);
+
+ int ret = 0;
BN_MONT_CTX *new_mont = NULL;
- if (!(m->d[0] & 1)) {
- OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
- return 0;
- }
- bits1 = BN_num_bits(p1);
- bits2 = BN_num_bits(p2);
- if (bits1 == 0 && bits2 == 0) {
- ret = BN_one(rr);
- return ret;
- }
-
- bits = (bits1 > bits2) ? bits1 : bits2;
-
- BN_CTX_start(ctx);
- d = BN_CTX_get(ctx);
- r = BN_CTX_get(ctx);
- val1[0] = BN_CTX_get(ctx);
- val2[0] = BN_CTX_get(ctx);
- if (!d || !r || !val1[0] || !val2[0]) {
- goto err;
- }
-
/* Allocate a montgomery context if it was not supplied by the caller. */
if (mont == NULL) {
new_mont = BN_MONT_CTX_new();
@@ -1292,156 +1267,21 @@
mont = new_mont;
}
- window1 = BN_window_bits_for_exponent_size(bits1);
- window2 = BN_window_bits_for_exponent_size(bits2);
-
- /* Build table for a1: val1[i] := a1^(2*i + 1) mod m for i = 0 ..
- * 2^(window1-1) */
- if (a1->neg || BN_ucmp(a1, m) >= 0) {
- if (!BN_mod(val1[0], a1, m, ctx)) {
- goto err;
- }
- a_mod_m = val1[0];
- } else {
- a_mod_m = a1;
- }
-
- if (BN_is_zero(a_mod_m)) {
- BN_zero(rr);
- ret = 1;
+ /* BN_mod_mul_montgomery removes one Montgomery factor, so passing one
+ * Montgomery-encoded and one non-Montgomery-encoded value gives a
+ * non-Montgomery-encoded result. */
+ if (!BN_mod_exp_mont(rr, a1, p1, m, ctx, mont) ||
+ !BN_mod_exp_mont(&tmp, a2, p2, m, ctx, mont) ||
+ !BN_to_montgomery(rr, rr, mont, ctx) ||
+ !BN_mod_mul_montgomery(rr, rr, &tmp, mont, ctx)) {
goto err;
}
- if (!BN_to_montgomery(val1[0], a_mod_m, mont, ctx)) {
- goto err;
- }
-
- if (window1 > 1) {
- if (!BN_mod_mul_montgomery(d, val1[0], val1[0], mont, ctx)) {
- goto err;
- }
-
- j = 1 << (window1 - 1);
- for (i = 1; i < j; i++) {
- if (((val1[i] = BN_CTX_get(ctx)) == NULL) ||
- !BN_mod_mul_montgomery(val1[i], val1[i - 1], d, mont, ctx)) {
- goto err;
- }
- }
- }
-
- /* Build table for a2: val2[i] := a2^(2*i + 1) mod m for i = 0 ..
- * 2^(window2-1) */
- if (a2->neg || BN_ucmp(a2, m) >= 0) {
- if (!BN_mod(val2[0], a2, m, ctx)) {
- goto err;
- }
- a_mod_m = val2[0];
- } else {
- a_mod_m = a2;
- }
-
- if (BN_is_zero(a_mod_m)) {
- BN_zero(rr);
- ret = 1;
- goto err;
- }
-
- if (!BN_to_montgomery(val2[0], a_mod_m, mont, ctx)) {
- goto err;
- }
-
- if (window2 > 1) {
- if (!BN_mod_mul_montgomery(d, val2[0], val2[0], mont, ctx)) {
- goto err;
- }
-
- j = 1 << (window2 - 1);
- for (i = 1; i < j; i++) {
- if (((val2[i] = BN_CTX_get(ctx)) == NULL) ||
- !BN_mod_mul_montgomery(val2[i], val2[i - 1], d, mont, ctx)) {
- goto err;
- }
- }
- }
-
- /* Now compute the power product, using independent windows. */
- r_is_one = 1;
- wvalue1 = 0; /* The 'value' of the first window */
- wvalue2 = 0; /* The 'value' of the second window */
- wpos1 = 0; /* If wvalue1 > 0, the bottom bit of the first window */
- wpos2 = 0; /* If wvalue2 > 0, the bottom bit of the second window */
-
- if (!BN_to_montgomery(r, BN_value_one(), mont, ctx)) {
- goto err;
- }
-
- for (b = bits - 1; b >= 0; b--) {
- if (!r_is_one) {
- if (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) {
- goto err;
- }
- }
-
- if (!wvalue1 && BN_is_bit_set(p1, b)) {
- /* consider bits b-window1+1 .. b for this window */
- i = b - window1 + 1;
- /* works for i<0 */
- while (!BN_is_bit_set(p1, i)) {
- i++;
- }
- wpos1 = i;
- wvalue1 = 1;
- for (i = b - 1; i >= wpos1; i--) {
- wvalue1 <<= 1;
- if (BN_is_bit_set(p1, i)) {
- wvalue1++;
- }
- }
- }
-
- if (!wvalue2 && BN_is_bit_set(p2, b)) {
- /* consider bits b-window2+1 .. b for this window */
- i = b - window2 + 1;
- while (!BN_is_bit_set(p2, i)) {
- i++;
- }
- wpos2 = i;
- wvalue2 = 1;
- for (i = b - 1; i >= wpos2; i--) {
- wvalue2 <<= 1;
- if (BN_is_bit_set(p2, i)) {
- wvalue2++;
- }
- }
- }
-
- if (wvalue1 && b == wpos1) {
- /* wvalue1 is odd and < 2^window1 */
- if (!BN_mod_mul_montgomery(r, r, val1[wvalue1 >> 1], mont, ctx)) {
- goto err;
- }
- wvalue1 = 0;
- r_is_one = 0;
- }
-
- if (wvalue2 && b == wpos2) {
- /* wvalue2 is odd and < 2^window2 */
- if (!BN_mod_mul_montgomery(r, r, val2[wvalue2 >> 1], mont, ctx)) {
- goto err;
- }
- wvalue2 = 0;
- r_is_one = 0;
- }
- }
-
- if (!BN_from_montgomery(rr, r, mont, ctx)) {
- goto err;
- }
ret = 1;
err:
BN_MONT_CTX_free(new_mont);
- BN_CTX_end(ctx);
+ BN_free(&tmp);
+
return ret;
}
diff --git a/include/openssl/bn.h b/include/openssl/bn.h
index 8e57965..e9be0f5 100644
--- a/include/openssl/bn.h
+++ b/include/openssl/bn.h
@@ -802,11 +802,6 @@
BN_CTX *ctx,
const BN_MONT_CTX *mont);
-OPENSSL_EXPORT int BN_mod_exp2_mont(BIGNUM *r, const BIGNUM *a1,
- const BIGNUM *p1, const BIGNUM *a2,
- const BIGNUM *p2, const BIGNUM *m,
- BN_CTX *ctx, const BN_MONT_CTX *mont);
-
/* Deprecated functions */
@@ -833,6 +828,13 @@
const BIGNUM *m, BN_CTX *ctx,
const BN_MONT_CTX *mont);
+/* BN_mod_exp2_mont calculates (a1^p1) * (a2^p2) mod m. It returns 1 on success
+ * or zero otherwise. */
+OPENSSL_EXPORT int BN_mod_exp2_mont(BIGNUM *r, const BIGNUM *a1,
+ const BIGNUM *p1, const BIGNUM *a2,
+ const BIGNUM *p2, const BIGNUM *m,
+ BN_CTX *ctx, const BN_MONT_CTX *mont);
+
/* Private functions */
