import of openssl-0.9.7j

9 files changed, 692 insertions, 60 deletions

diff --git a/src/lib/libcrypto/bn/asm/ppc.pl b/src/lib/libcrypto/bn/asm/ppc.pl
index 307c7ccb35..08e0053473 100644
--- a/src/lib/libcrypto/bn/asm/ppc.pl
+++ b/src/lib/libcrypto/bn/asm/ppc.pl
@@ -116,7 +116,7 @@ if ($opf =~ /32\.s/) {
         $UDIV=  "divwu";        # unsigned divide
         $UCMPI= "cmplwi";       # unsigned compare with immediate
         $UCMP=  "cmplw";        # unsigned compare
-        $COUNTZ="cntlzw";       # count leading zeros
+        $CNTLZ= "cntlzw";       # count leading zeros
         $SHL=   "slw";          # shift left
         $SHR=   "srw";          # unsigned shift right
         $SHRI=  "srwi";         # unsigned shift right by immediate     
@@ -124,6 +124,7 @@ if ($opf =~ /32\.s/) {
         $CLRU=  "clrlwi";       # clear upper bits
         $INSR=  "insrwi";       # insert right
         $ROTL=  "rotlwi";       # rotate left by immediate
+        $TR=    "tw";           # conditional trap
 } elsif ($opf =~ /64\.s/) {
         $BITS=  64;
         $BNSZ=  $BITS/8;
@@ -139,7 +140,7 @@ if ($opf =~ /32\.s/) {
         $UDIV=  "divdu";        # unsigned divide
         $UCMPI= "cmpldi";       # unsigned compare with immediate
         $UCMP=  "cmpld";        # unsigned compare
-        $COUNTZ="cntlzd";       # count leading zeros
+        $CNTLZ= "cntlzd";       # count leading zeros
         $SHL=   "sld";          # shift left
         $SHR=   "srd";          # unsigned shift right
         $SHRI=  "srdi";         # unsigned shift right by immediate     
@@ -147,6 +148,7 @@ if ($opf =~ /32\.s/) {
         $CLRU=  "clrldi";       # clear upper bits
         $INSR=  "insrdi";       # insert right 
         $ROTL=  "rotldi";       # rotate left by immediate
+        $TR=    "td";           # conditional trap
 } else { die "nonsense $opf"; }
 
 ( defined shift || open STDOUT,">$opf" ) || die "can't open $opf: $!";
@@ -1710,17 +1712,12 @@ Lppcasm_add_adios:
         bclr    BO_ALWAYS,CR0_LT        
 Lppcasm_div1:
         xor     r0,r0,r0                #r0=0
-        $COUNTZ r7,r5                   #r7 = num leading 0s in d.
-        subfic  r8,r7,$BITS             #r8 = BN_num_bits_word(d)
-        cmpi    0,0,r8,$BITS            #
-        bc      BO_IF,CR0_EQ,Lppcasm_div2       #proceed if (r8==$BITS) 
-        li      r9,1                    # r9=1
-        $SHL    r10,r9,r8               # r9<<=r8
-        $UCMP   0,r3,r10                #       
-        bc      BO_IF,CR0_GT,Lppcasm_div2       #or if (h > (1<<r8))
-        $UDIV   r3,r3,r0                #if not assert(0) divide by 0!
-                                        #that's how we signal overflow
-        bclr    BO_ALWAYS,CR0_LT        #return. NEVER REACHED.
+        li      r8,$BITS
+        $CNTLZ. r7,r5                   #r7 = num leading 0s in d.
+        bc      BO_IF,CR0_EQ,Lppcasm_div2       #proceed if no leading zeros
+        subf    r8,r7,r8                #r8 = BN_num_bits_word(d)
+        $SHR.   r9,r3,r8                #are there any bits above r8'th?
+        $TR     16,r9,r0                #if there're, signal to dump core...
 Lppcasm_div2:
         $UCMP   0,r3,r5                 #h>=d?
         bc      BO_IF,CR0_LT,Lppcasm_div3       #goto Lppcasm_div3 if not
diff --git a/src/lib/libcrypto/bn/asm/sparcv8plus.S b/src/lib/libcrypto/bn/asm/sparcv8plus.S
index 0074dfdb75..8c56e2e7e7 100644
--- a/src/lib/libcrypto/bn/asm/sparcv8plus.S
+++ b/src/lib/libcrypto/bn/asm/sparcv8plus.S
@@ -162,10 +162,14 @@
  * BN_ULONG w;
  */
 bn_mul_add_words:
+        sra     %o2,%g0,%o2     ! signx %o2
         brgz,a  %o2,.L_bn_mul_add_words_proceed
         lduw    [%o1],%g2
         retl
         clr     %o0
+        nop
+        nop
+        nop
 
 .L_bn_mul_add_words_proceed:
         srl     %o3,%g0,%o3     ! clruw %o3
@@ -260,10 +264,14 @@ bn_mul_add_words:
  * BN_ULONG w;
  */
 bn_mul_words:
+        sra     %o2,%g0,%o2     ! signx %o2
         brgz,a  %o2,.L_bn_mul_words_proceeed
         lduw    [%o1],%g2
         retl
         clr     %o0
+        nop
+        nop
+        nop
 
 .L_bn_mul_words_proceeed:
         srl     %o3,%g0,%o3     ! clruw %o3
@@ -344,10 +352,14 @@ bn_mul_words:
  * int n;
  */
 bn_sqr_words:
+        sra     %o2,%g0,%o2     ! signx %o2
         brgz,a  %o2,.L_bn_sqr_words_proceeed
         lduw    [%o1],%g2
         retl
         clr     %o0
+        nop
+        nop
+        nop
 
 .L_bn_sqr_words_proceeed:
         andcc   %o2,-4,%g0
@@ -445,6 +457,7 @@ bn_div_words:
  * int n;
  */
 bn_add_words:
+        sra     %o3,%g0,%o3     ! signx %o3
         brgz,a  %o3,.L_bn_add_words_proceed
         lduw    [%o1],%o4
         retl
@@ -454,7 +467,6 @@ bn_add_words:
         andcc   %o3,-4,%g0
         bz,pn   %icc,.L_bn_add_words_tail
         addcc   %g0,0,%g0       ! clear carry flag
-        nop
 
 .L_bn_add_words_loop:           ! wow! 32 aligned!
         dec     4,%o3
@@ -523,6 +535,7 @@ bn_add_words:
  * int n;
  */
 bn_sub_words:
+        sra     %o3,%g0,%o3     ! signx %o3
         brgz,a  %o3,.L_bn_sub_words_proceed
         lduw    [%o1],%o4
         retl
@@ -532,7 +545,6 @@ bn_sub_words:
         andcc   %o3,-4,%g0
         bz,pn   %icc,.L_bn_sub_words_tail
         addcc   %g0,0,%g0       ! clear carry flag
-        nop
 
 .L_bn_sub_words_loop:           ! wow! 32 aligned!
         dec     4,%o3
diff --git a/src/lib/libcrypto/bn/bn.h b/src/lib/libcrypto/bn/bn.h
index 3da6d8ced9..1251521c54 100644
--- a/src/lib/libcrypto/bn/bn.h
+++ b/src/lib/libcrypto/bn/bn.h
@@ -225,10 +225,23 @@ extern "C" {
 
 #define BN_FLG_MALLOCED         0x01
 #define BN_FLG_STATIC_DATA      0x02
+#define BN_FLG_EXP_CONSTTIME    0x04 /* avoid leaking exponent information through timings
+                                      * (BN_mod_exp_mont() will call BN_mod_exp_mont_consttime) */
 #define BN_FLG_FREE             0x8000  /* used for debuging */
 #define BN_set_flags(b,n)       ((b)->flags|=(n))
 #define BN_get_flags(b,n)       ((b)->flags&(n))
 
+/* get a clone of a BIGNUM with changed flags, for *temporary* use only
+ * (the two BIGNUMs cannot not be used in parallel!) */
+#define BN_with_flags(dest,b,n)  ((dest)->d=(b)->d, \
+                                  (dest)->top=(b)->top, \
+                                  (dest)->dmax=(b)->dmax, \
+                                  (dest)->neg=(b)->neg, \
+                                  (dest)->flags=(((dest)->flags & BN_FLG_MALLOCED) \
+                                                 |  ((b)->flags & ~BN_FLG_MALLOCED) \
+                                                 |  BN_FLG_STATIC_DATA \
+                                                 |  (n)))
+
 typedef struct bignum_st
         {
         BN_ULONG *d;    /* Pointer to an array of 'BN_BITS2' bit chunks. */
@@ -378,6 +391,8 @@ int	BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         const BIGNUM *m,BN_CTX *ctx);
 int     BN_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont);
 int     BN_mod_exp_mont_word(BIGNUM *r, BN_ULONG a, const BIGNUM *p,
         const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 int     BN_mod_exp2_mont(BIGNUM *r, const BIGNUM *a1, const BIGNUM *p1,
@@ -423,6 +438,19 @@ int	BN_is_prime_fasttest(const BIGNUM *p,int nchecks,
         void (*callback)(int,int,void *),BN_CTX *ctx,void *cb_arg,
         int do_trial_division);
 
+#ifdef OPENSSL_FIPS
+int BN_X931_derive_prime(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
+                        void (*cb)(int, int, void *), void *cb_arg,
+                        const BIGNUM *Xp, const BIGNUM *Xp1, const BIGNUM *Xp2,
+                        const BIGNUM *e, BN_CTX *ctx);
+int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx);
+int BN_X931_generate_prime(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
+                        BIGNUM *Xp1, BIGNUM *Xp2,
+                        const BIGNUM *Xp,
+                        const BIGNUM *e, BN_CTX *ctx,
+                        void (*cb)(int, int, void *), void *cb_arg);
+#endif
+
 BN_MONT_CTX *BN_MONT_CTX_new(void );
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
 int BN_mod_mul_montgomery(BIGNUM *r,const BIGNUM *a,const BIGNUM *b,
@@ -434,6 +462,8 @@ int BN_from_montgomery(BIGNUM *r,const BIGNUM *a,
 void BN_MONT_CTX_free(BN_MONT_CTX *mont);
 int BN_MONT_CTX_set(BN_MONT_CTX *mont,const BIGNUM *mod,BN_CTX *ctx);
 BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to,BN_MONT_CTX *from);
+BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, int lock,
+                                        const BIGNUM *mod, BN_CTX *ctx);
 
 BN_BLINDING *BN_BLINDING_new(BIGNUM *A,BIGNUM *Ai,BIGNUM *mod);
 void BN_BLINDING_free(BN_BLINDING *b);
@@ -510,11 +540,15 @@ void ERR_load_BN_strings(void);
 #define BN_F_BN_CTX_GET                                  116
 #define BN_F_BN_CTX_NEW                                  106
 #define BN_F_BN_DIV                                      107
+#define BN_F_BN_EXP                                      123
 #define BN_F_BN_EXPAND2                                  108
 #define BN_F_BN_EXPAND_INTERNAL                          120
 #define BN_F_BN_MOD_EXP2_MONT                            118
 #define BN_F_BN_MOD_EXP_MONT                             109
+#define BN_F_BN_MOD_EXP_MONT_CONSTTIME                   124
 #define BN_F_BN_MOD_EXP_MONT_WORD                        117
+#define BN_F_BN_MOD_EXP_RECP                             125
+#define BN_F_BN_MOD_EXP_SIMPLE                           126
 #define BN_F_BN_MOD_INVERSE                              110
 #define BN_F_BN_MOD_LSHIFT_QUICK                         119
 #define BN_F_BN_MOD_MUL_RECIPROCAL                       111
diff --git a/src/lib/libcrypto/bn/bn_asm.c b/src/lib/libcrypto/bn/bn_asm.c
index be8aa3ffc5..19978085b2 100644
--- a/src/lib/libcrypto/bn/bn_asm.c
+++ b/src/lib/libcrypto/bn/bn_asm.c
@@ -237,7 +237,7 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
         if (d == 0) return(BN_MASK2);
 
         i=BN_num_bits_word(d);
-        assert((i == BN_BITS2) || (h > (BN_ULONG)1<<i));
+        assert((i == BN_BITS2) || (h <= (BN_ULONG)1<<i));
 
         i=BN_BITS2-i;
         if (h >= d) h-=d;
diff --git a/src/lib/libcrypto/bn/bn_err.c b/src/lib/libcrypto/bn/bn_err.c
index fb84ee96d8..5dfac00c88 100644
--- a/src/lib/libcrypto/bn/bn_err.c
+++ b/src/lib/libcrypto/bn/bn_err.c
@@ -1,6 +1,6 @@
 /* crypto/bn/bn_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -64,52 +64,60 @@
 
 /* BEGIN ERROR CODES */
 #ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_BN,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_BN,0,reason)
+
 static ERR_STRING_DATA BN_str_functs[]=
         {
-{ERR_PACK(0,BN_F_BN_BLINDING_CONVERT,0),        "BN_BLINDING_convert"},
-{ERR_PACK(0,BN_F_BN_BLINDING_INVERT,0), "BN_BLINDING_invert"},
-{ERR_PACK(0,BN_F_BN_BLINDING_NEW,0),    "BN_BLINDING_new"},
-{ERR_PACK(0,BN_F_BN_BLINDING_UPDATE,0), "BN_BLINDING_update"},
-{ERR_PACK(0,BN_F_BN_BN2DEC,0),  "BN_bn2dec"},
-{ERR_PACK(0,BN_F_BN_BN2HEX,0),  "BN_bn2hex"},
-{ERR_PACK(0,BN_F_BN_CTX_GET,0), "BN_CTX_get"},
-{ERR_PACK(0,BN_F_BN_CTX_NEW,0), "BN_CTX_new"},
-{ERR_PACK(0,BN_F_BN_DIV,0),     "BN_div"},
-{ERR_PACK(0,BN_F_BN_EXPAND2,0), "bn_expand2"},
-{ERR_PACK(0,BN_F_BN_EXPAND_INTERNAL,0), "BN_EXPAND_INTERNAL"},
-{ERR_PACK(0,BN_F_BN_MOD_EXP2_MONT,0),   "BN_mod_exp2_mont"},
-{ERR_PACK(0,BN_F_BN_MOD_EXP_MONT,0),    "BN_mod_exp_mont"},
-{ERR_PACK(0,BN_F_BN_MOD_EXP_MONT_WORD,0),       "BN_mod_exp_mont_word"},
-{ERR_PACK(0,BN_F_BN_MOD_INVERSE,0),     "BN_mod_inverse"},
-{ERR_PACK(0,BN_F_BN_MOD_LSHIFT_QUICK,0),        "BN_mod_lshift_quick"},
-{ERR_PACK(0,BN_F_BN_MOD_MUL_RECIPROCAL,0),      "BN_mod_mul_reciprocal"},
-{ERR_PACK(0,BN_F_BN_MOD_SQRT,0),        "BN_mod_sqrt"},
-{ERR_PACK(0,BN_F_BN_MPI2BN,0),  "BN_mpi2bn"},
-{ERR_PACK(0,BN_F_BN_NEW,0),     "BN_new"},
-{ERR_PACK(0,BN_F_BN_RAND,0),    "BN_rand"},
-{ERR_PACK(0,BN_F_BN_RAND_RANGE,0),      "BN_rand_range"},
-{ERR_PACK(0,BN_F_BN_USUB,0),    "BN_usub"},
+{ERR_FUNC(BN_F_BN_BLINDING_CONVERT),    "BN_BLINDING_convert"},
+{ERR_FUNC(BN_F_BN_BLINDING_INVERT),     "BN_BLINDING_invert"},
+{ERR_FUNC(BN_F_BN_BLINDING_NEW),        "BN_BLINDING_new"},
+{ERR_FUNC(BN_F_BN_BLINDING_UPDATE),     "BN_BLINDING_update"},
+{ERR_FUNC(BN_F_BN_BN2DEC),      "BN_bn2dec"},
+{ERR_FUNC(BN_F_BN_BN2HEX),      "BN_bn2hex"},
+{ERR_FUNC(BN_F_BN_CTX_GET),     "BN_CTX_get"},
+{ERR_FUNC(BN_F_BN_CTX_NEW),     "BN_CTX_new"},
+{ERR_FUNC(BN_F_BN_DIV), "BN_div"},
+{ERR_FUNC(BN_F_BN_EXP), "BN_exp"},
+{ERR_FUNC(BN_F_BN_EXPAND2),     "bn_expand2"},
+{ERR_FUNC(BN_F_BN_EXPAND_INTERNAL),     "BN_EXPAND_INTERNAL"},
+{ERR_FUNC(BN_F_BN_MOD_EXP2_MONT),       "BN_mod_exp2_mont"},
+{ERR_FUNC(BN_F_BN_MOD_EXP_MONT),        "BN_mod_exp_mont"},
+{ERR_FUNC(BN_F_BN_MOD_EXP_MONT_CONSTTIME),      "BN_mod_exp_mont_consttime"},
+{ERR_FUNC(BN_F_BN_MOD_EXP_MONT_WORD),   "BN_mod_exp_mont_word"},
+{ERR_FUNC(BN_F_BN_MOD_EXP_RECP),        "BN_mod_exp_recp"},
+{ERR_FUNC(BN_F_BN_MOD_EXP_SIMPLE),      "BN_mod_exp_simple"},
+{ERR_FUNC(BN_F_BN_MOD_INVERSE), "BN_mod_inverse"},
+{ERR_FUNC(BN_F_BN_MOD_LSHIFT_QUICK),    "BN_mod_lshift_quick"},
+{ERR_FUNC(BN_F_BN_MOD_MUL_RECIPROCAL),  "BN_mod_mul_reciprocal"},
+{ERR_FUNC(BN_F_BN_MOD_SQRT),    "BN_mod_sqrt"},
+{ERR_FUNC(BN_F_BN_MPI2BN),      "BN_mpi2bn"},
+{ERR_FUNC(BN_F_BN_NEW), "BN_new"},
+{ERR_FUNC(BN_F_BN_RAND),        "BN_rand"},
+{ERR_FUNC(BN_F_BN_RAND_RANGE),  "BN_rand_range"},
+{ERR_FUNC(BN_F_BN_USUB),        "BN_usub"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA BN_str_reasons[]=
         {
-{BN_R_ARG2_LT_ARG3                       ,"arg2 lt arg3"},
-{BN_R_BAD_RECIPROCAL                     ,"bad reciprocal"},
-{BN_R_BIGNUM_TOO_LONG                    ,"bignum too long"},
-{BN_R_CALLED_WITH_EVEN_MODULUS           ,"called with even modulus"},
-{BN_R_DIV_BY_ZERO                        ,"div by zero"},
-{BN_R_ENCODING_ERROR                     ,"encoding error"},
-{BN_R_EXPAND_ON_STATIC_BIGNUM_DATA       ,"expand on static bignum data"},
-{BN_R_INPUT_NOT_REDUCED                  ,"input not reduced"},
-{BN_R_INVALID_LENGTH                     ,"invalid length"},
-{BN_R_INVALID_RANGE                      ,"invalid range"},
-{BN_R_NOT_A_SQUARE                       ,"not a square"},
-{BN_R_NOT_INITIALIZED                    ,"not initialized"},
-{BN_R_NO_INVERSE                         ,"no inverse"},
-{BN_R_P_IS_NOT_PRIME                     ,"p is not prime"},
-{BN_R_TOO_MANY_ITERATIONS                ,"too many iterations"},
-{BN_R_TOO_MANY_TEMPORARY_VARIABLES       ,"too many temporary variables"},
+{ERR_REASON(BN_R_ARG2_LT_ARG3)           ,"arg2 lt arg3"},
+{ERR_REASON(BN_R_BAD_RECIPROCAL)         ,"bad reciprocal"},
+{ERR_REASON(BN_R_BIGNUM_TOO_LONG)        ,"bignum too long"},
+{ERR_REASON(BN_R_CALLED_WITH_EVEN_MODULUS),"called with even modulus"},
+{ERR_REASON(BN_R_DIV_BY_ZERO)            ,"div by zero"},
+{ERR_REASON(BN_R_ENCODING_ERROR)         ,"encoding error"},
+{ERR_REASON(BN_R_EXPAND_ON_STATIC_BIGNUM_DATA),"expand on static bignum data"},
+{ERR_REASON(BN_R_INPUT_NOT_REDUCED)      ,"input not reduced"},
+{ERR_REASON(BN_R_INVALID_LENGTH)         ,"invalid length"},
+{ERR_REASON(BN_R_INVALID_RANGE)          ,"invalid range"},
+{ERR_REASON(BN_R_NOT_A_SQUARE)           ,"not a square"},
+{ERR_REASON(BN_R_NOT_INITIALIZED)        ,"not initialized"},
+{ERR_REASON(BN_R_NO_INVERSE)             ,"no inverse"},
+{ERR_REASON(BN_R_P_IS_NOT_PRIME)         ,"p is not prime"},
+{ERR_REASON(BN_R_TOO_MANY_ITERATIONS)    ,"too many iterations"},
+{ERR_REASON(BN_R_TOO_MANY_TEMPORARY_VARIABLES),"too many temporary variables"},
 {0,NULL}
         };
 
@@ -123,8 +131,8 @@ void ERR_load_BN_strings(void)
                 {
                 init=0;
 #ifndef OPENSSL_NO_ERR
-                ERR_load_strings(ERR_LIB_BN,BN_str_functs);
-                ERR_load_strings(ERR_LIB_BN,BN_str_reasons);
+                ERR_load_strings(0,BN_str_functs);
+                ERR_load_strings(0,BN_str_reasons);
 #endif
 
                 }
diff --git a/src/lib/libcrypto/bn/bn_exp.c b/src/lib/libcrypto/bn/bn_exp.c
index afdfd580fb..9e1e88abe8 100644
--- a/src/lib/libcrypto/bn/bn_exp.c
+++ b/src/lib/libcrypto/bn/bn_exp.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -113,6 +113,7 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+/* maximum precomputation table size for *variable* sliding windows */
 #define TABLE_SIZE      32
 
 /* this one works - simple but works */
@@ -121,6 +122,13 @@ int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         int i,bits,ret=0;
         BIGNUM *v,*rr;
 
+        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+                {
+                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                BNerr(BN_F_BN_EXP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return -1;
+                }
+
         BN_CTX_start(ctx);
         if ((r == a) || (r == p))
                 rr = BN_CTX_get(ctx);
@@ -204,7 +212,7 @@ int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
         if (BN_is_odd(m))
                 {
 #  ifdef MONT_EXP_WORD
-                if (a->top == 1 && !a->neg)
+                if (a->top == 1 && !a->neg && (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) == 0))
                         {
                         BN_ULONG A = a->d[0];
                         ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
@@ -234,6 +242,13 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         BIGNUM val[TABLE_SIZE];
         BN_RECP_CTX recp;
 
+        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+                {
+                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                BNerr(BN_F_BN_MOD_EXP_RECP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return -1;
+                }
+
         bits=BN_num_bits(p);
 
         if (bits == 0)
@@ -361,6 +376,11 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         BIGNUM val[TABLE_SIZE];
         BN_MONT_CTX *mont=NULL;
 
+        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+                {
+                return BN_mod_exp_mont_consttime(rr, a, p, m, ctx, in_mont);
+                }
+
         bn_check_top(a);
         bn_check_top(p);
         bn_check_top(m);
@@ -493,6 +513,212 @@ err:
         return(ret);
         }
 
+
+/* BN_mod_exp_mont_consttime() stores the precomputed powers in a specific layout
+ * so that accessing any of these table values shows the same access pattern as far
+ * as cache lines are concerned.  The following functions are used to transfer a BIGNUM
+ * from/to that table. */
+
+static int MOD_EXP_CTIME_COPY_TO_PREBUF(BIGNUM *b, int top, unsigned char *buf, int idx, int width)
+        {
+        size_t i, j;
+
+        if (bn_wexpand(b, top) == NULL)
+                return 0;
+        while (b->top < top)
+                {
+                b->d[b->top++] = 0;
+                }
+        
+        for (i = 0, j=idx; i < top * sizeof b->d[0]; i++, j+=width)
+                {
+                buf[j] = ((unsigned char*)b->d)[i];
+                }
+
+        bn_fix_top(b);
+        return 1;
+        }
+
+static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, unsigned char *buf, int idx, int width)
+        {
+        size_t i, j;
+
+        if (bn_wexpand(b, top) == NULL)
+                return 0;
+
+        for (i=0, j=idx; i < top * sizeof b->d[0]; i++, j+=width)
+                {
+                ((unsigned char*)b->d)[i] = buf[j];
+                }
+
+        b->top = top;
+        bn_fix_top(b);
+        return 1;
+        }       
+
+/* Given a pointer value, compute the next address that is a cache line multiple. */
+#define MOD_EXP_CTIME_ALIGN(x_) \
+        ((unsigned char*)(x_) + (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - (((BN_ULONG)(x_)) & (MOD_EXP_CTIME_MIN_CACHE_LINE_MASK))))
+
+/* This variant of BN_mod_exp_mont() uses fixed windows and the special
+ * precomputation memory layout to limit data-dependency to a minimum
+ * to protect secret exponents (cf. the hyper-threading timing attacks
+ * pointed out by Colin Percival,
+ * http://www.daemonology.net/hyperthreading-considered-harmful/)
+ */
+int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+                    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        int i,bits,ret=0,idx,window,wvalue;
+        int top;
+        BIGNUM *r;
+        const BIGNUM *aa;
+        BN_MONT_CTX *mont=NULL;
+
+        int numPowers;
+        unsigned char *powerbufFree=NULL;
+        int powerbufLen = 0;
+        unsigned char *powerbuf=NULL;
+        BIGNUM *computeTemp=NULL, *am=NULL;
+
+        bn_check_top(a);
+        bn_check_top(p);
+        bn_check_top(m);
+
+        top = m->top;
+
+        if (!(m->d[0] & 1))
+                {
+                BNerr(BN_F_BN_MOD_EXP_MONT_CONSTTIME,BN_R_CALLED_WITH_EVEN_MODULUS);
+                return(0);
+                }
+        bits=BN_num_bits(p);
+        if (bits == 0)
+                {
+                ret = BN_one(rr);
+                return ret;
+                }
+
+        /* Initialize BIGNUM context and allocate intermediate result */
+        BN_CTX_start(ctx);
+        r = BN_CTX_get(ctx);
+        if (r == NULL) goto err;
+
+        /* Allocate a montgomery context if it was not supplied by the caller.
+         * If this is not done, things will break in the montgomery part.
+         */
+        if (in_mont != NULL)
+                mont=in_mont;
+        else
+                {
+                if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
+                if (!BN_MONT_CTX_set(mont,m,ctx)) goto err;
+                }
+
+        /* Get the window size to use with size of p. */
+        window = BN_window_bits_for_ctime_exponent_size(bits);
+
+        /* Allocate a buffer large enough to hold all of the pre-computed
+         * powers of a.
+         */
+        numPowers = 1 << window;
+        powerbufLen = sizeof(m->d[0])*top*numPowers;
+        if ((powerbufFree=(unsigned char*)OPENSSL_malloc(powerbufLen+MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH)) == NULL)
+                goto err;
+                
+        powerbuf = MOD_EXP_CTIME_ALIGN(powerbufFree);
+        memset(powerbuf, 0, powerbufLen);
+
+        /* Initialize the intermediate result. Do this early to save double conversion,
+         * once each for a^0 and intermediate result.
+         */
+        if (!BN_to_montgomery(r,BN_value_one(),mont,ctx)) goto err;
+        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(r, top, powerbuf, 0, numPowers)) goto err;
+
+        /* Initialize computeTemp as a^1 with montgomery precalcs */
+        computeTemp = BN_CTX_get(ctx);
+        am = BN_CTX_get(ctx);
+        if (computeTemp==NULL || am==NULL) goto err;
+
+        if (a->neg || BN_ucmp(a,m) >= 0)
+                {
+                if (!BN_mod(am,a,m,ctx))
+                        goto err;
+                aa= am;
+                }
+        else
+                aa=a;
+        if (!BN_to_montgomery(am,aa,mont,ctx)) goto err;
+        if (!BN_copy(computeTemp, am)) goto err;
+        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(am, top, powerbuf, 1, numPowers)) goto err;
+
+        /* If the window size is greater than 1, then calculate
+         * val[i=2..2^winsize-1]. Powers are computed as a*a^(i-1)
+         * (even powers could instead be computed as (a^(i/2))^2
+         * to use the slight performance advantage of sqr over mul).
+         */
+        if (window > 1)
+                {
+                for (i=2; i<numPowers; i++)
+                        {
+                        /* Calculate a^i = a^(i-1) * a */
+                        if (!BN_mod_mul_montgomery(computeTemp,am,computeTemp,mont,ctx))
+                                goto err;
+                        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(computeTemp, top, powerbuf, i, numPowers)) goto err;
+                        }
+                }
+
+        /* Adjust the number of bits up to a multiple of the window size.
+         * If the exponent length is not a multiple of the window size, then
+         * this pads the most significant bits with zeros to normalize the
+         * scanning loop to there's no special cases.
+         *
+         * * NOTE: Making the window size a power of two less than the native
+         * * word size ensures that the padded bits won't go past the last
+         * * word in the internal BIGNUM structure. Going past the end will
+         * * still produce the correct result, but causes a different branch
+         * * to be taken in the BN_is_bit_set function.
+         */
+        bits = ((bits+window-1)/window)*window;
+        idx=bits-1;     /* The top bit of the window */
+
+        /* Scan the exponent one window at a time starting from the most
+         * significant bits.
+         */
+        while (idx >= 0)
+                {
+                wvalue=0; /* The 'value' of the window */
+                
+                /* Scan the window, squaring the result as we go */
+                for (i=0; i<window; i++,idx--)
+                        {
+                        if (!BN_mod_mul_montgomery(r,r,r,mont,ctx))     goto err;
+                        wvalue = (wvalue<<1)+BN_is_bit_set(p,idx);
+                        }
+                
+                /* Fetch the appropriate pre-computed value from the pre-buf */
+                if (!MOD_EXP_CTIME_COPY_FROM_PREBUF(computeTemp, top, powerbuf, wvalue, numPowers)) goto err;
+
+                /* Multiply the result into the intermediate result */
+                if (!BN_mod_mul_montgomery(r,r,computeTemp,mont,ctx)) goto err;
+                }
+
+        /* Convert the final result from montgomery to standard format */
+        if (!BN_from_montgomery(rr,r,mont,ctx)) goto err;
+        ret=1;
+err:
+        if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
+        if (powerbuf!=NULL)
+                {
+                OPENSSL_cleanse(powerbuf,powerbufLen);
+                OPENSSL_free(powerbufFree);
+                }
+        if (am!=NULL) BN_clear(am);
+        if (computeTemp!=NULL) BN_clear(computeTemp);
+        BN_CTX_end(ctx);
+        return(ret);
+        }
+
 int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
         {
@@ -517,6 +743,13 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
 #define BN_TO_MONTGOMERY_WORD(r, w, mont) \
                 (BN_set_word(r, (w)) && BN_to_montgomery(r, r, (mont), ctx))
 
+        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+                {
+                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                BNerr(BN_F_BN_MOD_EXP_MONT_WORD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return -1;
+                }
+
         bn_check_top(p);
         bn_check_top(m);
 
@@ -644,6 +877,13 @@ int BN_mod_exp_simple(BIGNUM *r,
         BIGNUM *d;
         BIGNUM val[TABLE_SIZE];
 
+        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+                {
+                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                BNerr(BN_F_BN_MOD_EXP_SIMPLE,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return -1;
+                }
+
         bits=BN_num_bits(p);
 
         if (bits == 0)
diff --git a/src/lib/libcrypto/bn/bn_lcl.h b/src/lib/libcrypto/bn/bn_lcl.h
index 253e195e23..a84998f2bd 100644
--- a/src/lib/libcrypto/bn/bn_lcl.h
+++ b/src/lib/libcrypto/bn/bn_lcl.h
@@ -177,6 +177,45 @@ struct bignum_ctx
 
 
 
+/* BN_mod_exp_mont_conttime is based on the assumption that the
+ * L1 data cache line width of the target processor is at least
+ * the following value.
+ */
+#define MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH      ( 64 )
+#define MOD_EXP_CTIME_MIN_CACHE_LINE_MASK       (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - 1)
+
+/* Window sizes optimized for fixed window size modular exponentiation
+ * algorithm (BN_mod_exp_mont_consttime).
+ *
+ * To achieve the security goals of BN_mode_exp_mont_consttime, the
+ * maximum size of the window must not exceed
+ * log_2(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH). 
+ *
+ * Window size thresholds are defined for cache line sizes of 32 and 64,
+ * cache line sizes where log_2(32)=5 and log_2(64)=6 respectively. A
+ * window size of 7 should only be used on processors that have a 128
+ * byte or greater cache line size.
+ */
+#if MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 64
+
+#  define BN_window_bits_for_ctime_exponent_size(b) \
+                ((b) > 937 ? 6 : \
+                 (b) > 306 ? 5 : \
+                 (b) >  89 ? 4 : \
+                 (b) >  22 ? 3 : 1)
+#  define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE    (6)
+
+#elif MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 32
+
+#  define BN_window_bits_for_ctime_exponent_size(b) \
+                ((b) > 306 ? 5 : \
+                 (b) >  89 ? 4 : \
+                 (b) >  22 ? 3 : 1)
+#  define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE    (5)
+
+#endif
+
+
 /* Pentium pro 16,16,16,32,64 */
 /* Alpha       16,16,16,16.64 */
 #define BN_MULL_SIZE_NORMAL                     (16) /* 32 */
diff --git a/src/lib/libcrypto/bn/bn_mont.c b/src/lib/libcrypto/bn/bn_mont.c
index b79b1b60da..3572e5a690 100644
--- a/src/lib/libcrypto/bn/bn_mont.c
+++ b/src/lib/libcrypto/bn/bn_mont.c
@@ -347,3 +347,23 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
         return(to);
         }
 
+BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, int lock,
+                                        const BIGNUM *mod, BN_CTX *ctx)
+        {
+        if (*pmont)
+                return *pmont;
+        CRYPTO_w_lock(lock);
+        if (!*pmont)
+                {
+                *pmont = BN_MONT_CTX_new();
+                if (*pmont && !BN_MONT_CTX_set(*pmont, mod, ctx))
+                        {
+                        BN_MONT_CTX_free(*pmont);
+                        *pmont = NULL;
+                        }
+                }
+        CRYPTO_w_unlock(lock);
+        return *pmont;
+        }
+                
+
diff --git a/src/lib/libcrypto/bn/bn_x931p.c b/src/lib/libcrypto/bn/bn_x931p.c
new file mode 100644
index 0000000000..c64410dd3a
--- /dev/null
+++ b/src/lib/libcrypto/bn/bn_x931p.c
@@ -0,0 +1,282 @@
+/* bn_x931p.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2005.
+ */
+/* ====================================================================
+ * Copyright (c) 2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/bn.h>
+
+#ifdef OPENSSL_FIPS
+
+/* X9.31 routines for prime derivation */
+
+
+/* X9.31 prime derivation. This is used to generate the primes pi
+ * (p1, p2, q1, q2) from a parameter Xpi by checking successive odd
+ * integers.
+ */
+
+static int bn_x931_derive_pi(BIGNUM *pi, const BIGNUM *Xpi, BN_CTX *ctx,
+                        void (*cb)(int, int, void *), void *cb_arg)
+        {
+        int i = 0;
+        if (!BN_copy(pi, Xpi))
+                return 0;
+        if (!BN_is_odd(pi) && !BN_add_word(pi, 1))
+                return 0;
+        for(;;)
+                {
+                i++;
+                if (cb)
+                        cb(0, i, cb_arg);
+                /* NB 27 MR is specificed in X9.31 */
+                if (BN_is_prime_fasttest(pi, 27, cb, ctx, cb_arg, 1))
+                        break;
+                if (!BN_add_word(pi, 2))
+                        return 0;
+                }
+        if (cb)
+                cb(2, i, cb_arg);
+        return 1;
+        }
+
+/* This is the main X9.31 prime derivation function. From parameters
+ * Xp1, Xp2 and Xp derive the prime p. If the parameters p1 or p2 are
+ * not NULL they will be returned too: this is needed for testing.
+ */
+
+int BN_X931_derive_prime(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
+                        void (*cb)(int, int, void *), void *cb_arg,
+                        const BIGNUM *Xp, const BIGNUM *Xp1, const BIGNUM *Xp2,
+                        const BIGNUM *e, BN_CTX *ctx)
+        {
+        int ret = 0;
+
+        BIGNUM *t, *p1p2, *pm1;
+
+        /* Only even e supported */
+        if (!BN_is_odd(e))
+                return 0;
+
+        BN_CTX_start(ctx);
+        if (!p1)
+                p1 = BN_CTX_get(ctx);
+
+        if (!p2)
+                p2 = BN_CTX_get(ctx);
+
+        t = BN_CTX_get(ctx);
+
+        p1p2 = BN_CTX_get(ctx);
+
+        pm1 = BN_CTX_get(ctx);
+
+        if (!bn_x931_derive_pi(p1, Xp1, ctx, cb, cb_arg))
+                goto err;
+
+        if (!bn_x931_derive_pi(p2, Xp2, ctx, cb, cb_arg))
+                goto err;
+
+        if (!BN_mul(p1p2, p1, p2, ctx))
+                goto err;
+
+        /* First set p to value of Rp */
+
+        if (!BN_mod_inverse(p, p2, p1, ctx))
+                goto err;
+
+        if (!BN_mul(p, p, p2, ctx))
+                goto err;
+
+        if (!BN_mod_inverse(t, p1, p2, ctx))
+                goto err;
+
+        if (!BN_mul(t, t, p1, ctx))
+                goto err;
+
+        if (!BN_sub(p, p, t))
+                goto err;
+
+        if (p->neg && !BN_add(p, p, p1p2))
+                goto err;
+
+        /* p now equals Rp */
+
+        if (!BN_mod_sub(p, p, Xp, p1p2, ctx))
+                goto err;
+
+        if (!BN_add(p, p, Xp))
+                goto err;
+
+        /* p now equals Yp0 */
+
+        for (;;)
+                {
+                int i = 1;
+                if (cb)
+                        cb(0, i++, cb_arg);
+                if (!BN_copy(pm1, p))
+                        goto err;
+                if (!BN_sub_word(pm1, 1))
+                        goto err;
+                if (!BN_gcd(t, pm1, e, ctx))
+                        goto err;
+                if (BN_is_one(t)
+                /* X9.31 specifies 8 MR and 1 Lucas test or any prime test
+                 * offering similar or better guarantees 50 MR is considerably 
+                 * better.
+                 */
+                        && BN_is_prime_fasttest(p, 50, cb, ctx, cb_arg, 1))
+                        break;
+                if (!BN_add(p, p, p1p2))
+                        goto err;
+                }
+
+        if (cb)
+                cb(3, 0, cb_arg);
+
+        ret = 1;
+
+        err:
+
+        BN_CTX_end(ctx);
+
+        return ret;
+        }
+
+/* Generate pair of paramters Xp, Xq for X9.31 prime generation.
+ * Note: nbits paramter is sum of number of bits in both.
+ */
+
+int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx)
+        {
+        BIGNUM *t;
+        int i;
+        /* Number of bits for each prime is of the form
+         * 512+128s for s = 0, 1, ...
+         */
+        if ((nbits < 1024) || (nbits & 0xff))
+                return 0;
+        nbits >>= 1;
+        /* The random value Xp must be between sqrt(2) * 2^(nbits-1) and
+         * 2^nbits - 1. By setting the top two bits we ensure that the lower
+         * bound is exceeded.
+         */
+        if (!BN_rand(Xp, nbits, 1, 0))
+                return 0;
+
+        BN_CTX_start(ctx);
+        t = BN_CTX_get(ctx);
+
+        for (i = 0; i < 1000; i++)
+                {
+                if (!BN_rand(Xq, nbits, 1, 0))
+                        return 0;
+                /* Check that |Xp - Xq| > 2^(nbits - 100) */
+                BN_sub(t, Xp, Xq);
+                if (BN_num_bits(t) > (nbits - 100))
+                        break;
+                }
+
+        BN_CTX_end(ctx);
+
+        if (i < 1000)
+                return 1;
+
+        return 0;
+
+        }
+
+/* Generate primes using X9.31 algorithm. Of the values p, p1, p2, Xp1
+ * and Xp2 only 'p' needs to be non-NULL. If any of the others are not NULL
+ * the relevant parameter will be stored in it.
+ *
+ * Due to the fact that |Xp - Xq| > 2^(nbits - 100) must be satisfied Xp and Xq
+ * are generated using the previous function and supplied as input.
+ */
+
+int BN_X931_generate_prime(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
+                        BIGNUM *Xp1, BIGNUM *Xp2,
+                        const BIGNUM *Xp,
+                        const BIGNUM *e, BN_CTX *ctx,
+                        void (*cb)(int, int, void *), void *cb_arg)
+        {
+        int ret = 0;
+
+        BN_CTX_start(ctx);
+        if (!Xp1)
+                Xp1 = BN_CTX_get(ctx);
+        if (!Xp2)
+                Xp2 = BN_CTX_get(ctx);
+
+        if (!BN_rand(Xp1, 101, 0, 0))
+                goto error;
+        if (!BN_rand(Xp2, 101, 0, 0))
+                goto error;
+        if (!BN_X931_derive_prime(p, p1, p2, cb, cb_arg,
+                                                Xp, Xp1, Xp2, e, ctx))
+                goto error;
+
+        ret = 1;
+
+        error:
+        BN_CTX_end(ctx);
+
+        return ret;
+
+        }
+
+#endif