openbsd/src/lib/libcrypto/bn/bn_mod.c, branch OPENBSD_7_9

Use err_local.h rather than err.h in most places

2025-05-10T05:54:39+00:00

ok jsing

Hide symbols in bn

2023-07-08T12:21:58+00:00

ok tb@

Disallow aliasing of return value and modulus

2023-06-13T09:28:13+00:00

All the functions changed in this commit would silently misbehave if the return value aliases the modulus, most of the time they would succeed and return an incorrect result of 0 in that situation. This adjusts all the functions in BN_mod.c, others and documentation will follow later. Prompted by a bug report about BN_mod_inverse() by Guido Vranken. ok jsing

Convert BN_copy() with explicit comparison against NULL to bn_copy()

2023-03-27T10:21:23+00:00

ok jsing

Clean up and simplify BN_mod_lshift{,_quick}().

2023-02-03T05:15:40+00:00

BN_mod_lshift() already has a BN_CTX available, make use of it rather than calling BN_dup() and BN_free(). In BN_mod_lshift_quick(), BN_copy() already handles dst == src, so avoid checking this before the call. The max_shift == 0 case can also be handled without code duplication. And as with other *_quick() functions, use BN_ucmp() and BN_usub() directly given the 0 <= a < m constraint. ok tb@

Clean up BN_mod_mul() and simplify BN_mod_sqr().

2023-02-03T05:10:57+00:00

Use the same naming/code pattern in BN_mod_mul() as is used in BN_mul(). Note that the 'rr' allocation is unnecessary, since both BN_mul() and BN_sqr() handle the case where r == a || r == b. However, it avoids a potential copy on the exit from BN_mul()/BN_sqr(), so leave it in place for now. Turn BN_mod_sqr() into a wrapper that calls BN_mod_mul(), since it already calls BN_sqr() in the a == b. The supposed gain of calling BN_mod_ct() instead of BN_nnmod() does not really exist. ok tb@

Simplify BN_mod_{lshift1,sub}_quick().

2023-02-03T05:06:20+00:00

The BN_mod_.*_quick() functions require that their inputs are non-negative and are already reduced. As such, they can and should use BN_ucmp() and BN_usub() instead of BN_cmp() and BN_add()/BN_sub() (which internally call BN_uadd()/BN_usub() and potentially BN_cmp()). ok tb@

Simplify BN_nnmod().

2023-02-03T04:55:13+00:00

In the case that the result is negative (i.e. one of a or m is negative), the positive result can be achieved via a single BN_usub(). This simplifies BN_nnmod() and avoids indirection via BN_add()/BN_sub(), which do BN_cmp() and then call into BN_uadd()/BN_usub(). ok tb@

Turn BN_mod_{ct,nonct}() into symbols.

2023-02-03T04:47:59+00:00

Also use accurate/useful variables names. ok tb@

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook