自学教程：C++ BN_CTX_end函数代码示例

//.........这里部分代码省略.........     */    if (flen > num) {        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,               RSA_R_DATA_GREATER_THAN_MOD_LEN);        goto err;    }    /* make data into a big number */    if (BN_bin2bn(from, (int)flen, f) == NULL)        goto err;    if (BN_ucmp(f, rsa->n) >= 0) {        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);        goto err;    }    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);        if (blinding == NULL) {            RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);            goto err;        }    }    if (blinding != NULL) {        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {            RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);            goto err;        }        if (!rsa_blinding_convert(blinding, f, unblind, ctx))            goto err;    }    /* do the decrypt */    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||        ((rsa->p != NULL) &&         (rsa->q != NULL) &&         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))            goto err;    } else {        BIGNUM local_d;        BIGNUM *d = NULL;        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {            d = &local_d;            BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);        } else            d = rsa->d;        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)            if (!BN_MONT_CTX_set_locked                (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))                goto err;        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,                                   rsa->_method_mod_n))            goto err;    }    if (blinding)        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))            goto err;    p = buf;    j = BN_bn2bin(ret, p);      /* j is only used with no-padding mode */    switch (padding) {    case RSA_PKCS1_PADDING:        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);        break;# ifndef OPENSSL_NO_SHA    case RSA_PKCS1_OAEP_PADDING:        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);        break;# endif    case RSA_SSLV23_PADDING:        r = RSA_padding_check_SSLv23(to, num, buf, j, num);        break;    case RSA_NO_PADDING:        r = RSA_padding_check_none(to, num, buf, j, num);        break;    default:        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);        goto err;    }    if (r < 0)        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED); err:    if (ctx != NULL) {        BN_CTX_end(ctx);        BN_CTX_free(ctx);    }    if (buf != NULL) {        OPENSSL_cleanse(buf, num);        OPENSSL_free(buf);    }    return (r);}

//.........这里部分代码省略.........    }    if (EC_POINT_is_at_infinity (group, b))        return 1;    if (a->Z_is_one && b->Z_is_one)    {        return ((BN_cmp (&a->X, &b->X) == 0) && BN_cmp (&a->Y, &b->Y) == 0) ? 0 : 1;    }    field_mul = group->meth->field_mul;    field_sqr = group->meth->field_sqr;    if (ctx == NULL)    {        ctx = new_ctx = BN_CTX_new ();        if (ctx == NULL)            return -1;    }    BN_CTX_start (ctx);    tmp1 = BN_CTX_get (ctx);    tmp2 = BN_CTX_get (ctx);    Za23 = BN_CTX_get (ctx);    Zb23 = BN_CTX_get (ctx);    if (Zb23 == NULL)        goto end;    /* We have to decide whether     *     (X_a/Z_a^2, Y_a/Z_a^3) = (X_b/Z_b^2, Y_b/Z_b^3),     * or equivalently, whether     *     (X_a*Z_b^2, Y_a*Z_b^3) = (X_b*Z_a^2, Y_b*Z_a^3).     */    if (!b->Z_is_one)    {        if (!field_sqr (group, Zb23, &b->Z, ctx))            goto end;        if (!field_mul (group, tmp1, &a->X, Zb23, ctx))            goto end;        tmp1_ = tmp1;    }    else        tmp1_ = &a->X;    if (!a->Z_is_one)    {        if (!field_sqr (group, Za23, &a->Z, ctx))            goto end;        if (!field_mul (group, tmp2, &b->X, Za23, ctx))            goto end;        tmp2_ = tmp2;    }    else        tmp2_ = &b->X;    /* compare  X_a*Z_b^2  with  X_b*Z_a^2 */    if (BN_cmp (tmp1_, tmp2_) != 0)    {        ret = 1;                /* points differ */        goto end;    }    if (!b->Z_is_one)    {        if (!field_mul (group, Zb23, Zb23, &b->Z, ctx))            goto end;        if (!field_mul (group, tmp1, &a->Y, Zb23, ctx))            goto end;        /* tmp1_ = tmp1 */    }    else        tmp1_ = &a->Y;    if (!a->Z_is_one)    {        if (!field_mul (group, Za23, Za23, &a->Z, ctx))            goto end;        if (!field_mul (group, tmp2, &b->Y, Za23, ctx))            goto end;        /* tmp2_ = tmp2 */    }    else        tmp2_ = &b->Y;    /* compare  Y_a*Z_b^3  with  Y_b*Z_a^3 */    if (BN_cmp (tmp1_, tmp2_) != 0)    {        ret = 1;                /* points differ */        goto end;    }    /* points are equal */    ret = 0;  end:    BN_CTX_end (ctx);    if (new_ctx != NULL)        BN_CTX_free (new_ctx);    return ret;}

int ec_GFp_simple_group_set_curve (EC_GROUP * group, const BIGNUM * p, const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx){    int ret = 0;    BN_CTX *new_ctx = NULL;    BIGNUM *tmp_a;    /* p must be a prime > 3 */    if (BN_num_bits (p) <= 2 || !BN_is_odd (p))    {        ECerr (EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);        return 0;    }    if (ctx == NULL)    {        ctx = new_ctx = BN_CTX_new ();        if (ctx == NULL)            return 0;    }    BN_CTX_start (ctx);    tmp_a = BN_CTX_get (ctx);    if (tmp_a == NULL)        goto err;    /* group->field */    if (!BN_copy (&group->field, p))        goto err;    BN_set_negative (&group->field, 0);    /* group->a */    if (!BN_nnmod (tmp_a, a, p, ctx))        goto err;    if (group->meth->field_encode)    {        if (!group->meth->field_encode (group, &group->a, tmp_a, ctx))            goto err;    }    else if (!BN_copy (&group->a, tmp_a))        goto err;    /* group->b */    if (!BN_nnmod (&group->b, b, p, ctx))        goto err;    if (group->meth->field_encode)        if (!group->meth->field_encode (group, &group->b, &group->b, ctx))            goto err;    /* group->a_is_minus3 */    if (!BN_add_word (tmp_a, 3))        goto err;    group->a_is_minus3 = (0 == BN_cmp (tmp_a, &group->field));    ret = 1;  err:    BN_CTX_end (ctx);    if (new_ctx != NULL)        BN_CTX_free (new_ctx);    return ret;}

//.........这里部分代码省略......... * avoiding conditional branches. */static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,    const BIGNUM *scalar, const EC_POINT *point, BN_CTX *ctx){	BIGNUM *x1, *x2, *z1, *z2;	int ret = 0, i;	BN_ULONG mask, word;	if (r == point) {		ECerr(EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY, EC_R_INVALID_ARGUMENT);		return 0;	}	/* if result should be point at infinity */	if ((scalar == NULL) || BN_is_zero(scalar) || (point == NULL) ||	    EC_POINT_is_at_infinity(group, point) > 0) {		return EC_POINT_set_to_infinity(group, r);	}	/* only support affine coordinates */	if (!point->Z_is_one)		return 0;	/* Since point_multiply is static we can guarantee that ctx != NULL. */	BN_CTX_start(ctx);	if ((x1 = BN_CTX_get(ctx)) == NULL)		goto err;	if ((z1 = BN_CTX_get(ctx)) == NULL)		goto err;	x2 = &r->X;	z2 = &r->Y;	bn_wexpand(x1, group->field.top);	bn_wexpand(z1, group->field.top);	bn_wexpand(x2, group->field.top);	bn_wexpand(z2, group->field.top);	if (!BN_GF2m_mod_arr(x1, &point->X, group->poly))		goto err;	/* x1 = x */	if (!BN_one(z1))		goto err;	/* z1 = 1 */	if (!group->meth->field_sqr(group, z2, x1, ctx))		goto err;	/* z2 = x1^2 = x^2 */	if (!group->meth->field_sqr(group, x2, z2, ctx))		goto err;	if (!BN_GF2m_add(x2, x2, &group->b))		goto err;	/* x2 = x^4 + b */	/* find top most bit and go one past it */	i = scalar->top - 1;	mask = BN_TBIT;	word = scalar->d[i];	while (!(word & mask))		mask >>= 1;	mask >>= 1;	/* if top most bit was at word break, go to next word */	if (!mask) {		i--;		mask = BN_TBIT;	}	for (; i >= 0; i--) {		word = scalar->d[i];		while (mask) {			BN_consttime_swap(word & mask, x1, x2, group->field.top);			BN_consttime_swap(word & mask, z1, z2, group->field.top);			if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx))				goto err;			if (!gf2m_Mdouble(group, x1, z1, ctx))				goto err;			BN_consttime_swap(word & mask, x1, x2, group->field.top);			BN_consttime_swap(word & mask, z1, z2, group->field.top);			mask >>= 1;		}		mask = BN_TBIT;	}	/* convert out of "projective" coordinates */	i = gf2m_Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx);	if (i == 0)		goto err;	else if (i == 1) {		if (!EC_POINT_set_to_infinity(group, r))			goto err;	} else {		if (!BN_one(&r->Z))			goto err;		r->Z_is_one = 1;	}	/* GF(2^m) field elements should always have BIGNUM::neg = 0 */	BN_set_negative(&r->X, 0);	BN_set_negative(&r->Y, 0);	ret = 1;err:	BN_CTX_end(ctx);	return ret;}

int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)	{	int    r = 0;	BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;	BN_CTX *ctx_new = NULL;	/* compare the field types*/	if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=	    EC_METHOD_get_field_type(EC_GROUP_method_of(b)))		return 1;	/* compare the curve name (if present) */	if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&	    EC_GROUP_get_curve_name(a) == EC_GROUP_get_curve_name(b))		return 0;	if (!ctx)		ctx_new = ctx = BN_CTX_new();	if (!ctx)		return -1;		BN_CTX_start(ctx);	a1 = BN_CTX_get(ctx);	a2 = BN_CTX_get(ctx);	a3 = BN_CTX_get(ctx);	b1 = BN_CTX_get(ctx);	b2 = BN_CTX_get(ctx);	b3 = BN_CTX_get(ctx);	if (!b3)		{		BN_CTX_end(ctx);		if (ctx_new)			BN_CTX_free(ctx);		return -1;		}	/* XXX This approach assumes that the external representation	 * of curves over the same field type is the same.	 */	if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||	    !b->meth->group_get_curve(b, b1, b2, b3, ctx))		r = 1;	if (r || BN_cmp(a1, b1) || BN_cmp(a2, b2) || BN_cmp(a3, b3))		r = 1;	/* XXX EC_POINT_cmp() assumes that the methods are equal */	if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),	    EC_GROUP_get0_generator(b), ctx))		r = 1;	if (!r)		{		/* compare the order and cofactor */		if (!EC_GROUP_get_order(a, a1, ctx) ||		    !EC_GROUP_get_order(b, b1, ctx) ||		    !EC_GROUP_get_cofactor(a, a2, ctx) ||		    !EC_GROUP_get_cofactor(b, b2, ctx))			{			BN_CTX_end(ctx);			if (ctx_new)				BN_CTX_free(ctx);			return -1;			}		if (BN_cmp(a1, b1) || BN_cmp(a2, b2))			r = 1;		}	BN_CTX_end(ctx);	if (ctx_new)		BN_CTX_free(ctx);	return r;	}

static int encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,                   const uint8_t *in, size_t in_len, int padding) {  const unsigned rsa_size = RSA_size(rsa);  BIGNUM *f, *result;  uint8_t *buf = NULL;  BN_CTX *ctx = NULL;  int i, ret = 0;  if (rsa_size > OPENSSL_RSA_MAX_MODULUS_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE);    return 0;  }  if (max_out < rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);    return 0;  }  if (BN_ucmp(rsa->n, rsa->e) <= 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  /* for large moduli, enforce exponent limit */  if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS &&      BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  buf = OPENSSL_malloc(rsa_size);  if (!f || !result || !buf) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  switch (padding) {    case RSA_PKCS1_PADDING:      i = RSA_padding_add_PKCS1_type_2(buf, rsa_size, in, in_len);      break;    case RSA_PKCS1_OAEP_PADDING:      /* Use the default parameters: SHA-1 for both hashes and no label. */      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len,                                          NULL, 0, NULL, NULL);      break;    case RSA_NO_PADDING:      i = RSA_padding_add_none(buf, rsa_size, in, in_len);      break;    default:      OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE);      goto err;  }  if (i <= 0) {    goto err;  }  if (BN_bin2bn(buf, rsa_size, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    /* usually the padding functions would catch this */    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {    if (BN_MONT_CTX_set_locked(&rsa->_method_mod_n, &rsa->lock, rsa->n, ctx) ==        NULL) {      goto err;    }  }  if (!rsa->meth->bn_mod_exp(result, f, rsa->e, rsa->n, ctx,                             rsa->_method_mod_n)) {    goto err;  }  /* put in leading 0 bytes if the number is less than the length of the   * modulus */  if (!BN_bn2bin_padded(out, rsa_size, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  *out_len = rsa_size;  ret = 1;err:  if (ctx != NULL) {    BN_CTX_end(ctx);//.........这里部分代码省略.........

//.........这里部分代码省略.........        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);        return -1;    }    ctx = BN_CTX_new();    if (ctx == NULL) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);        return -1;    }    BN_CTX_start(ctx);    u1 = BN_CTX_get(ctx);    u2 = BN_CTX_get(ctx);    m = BN_CTX_get(ctx);    X = BN_CTX_get(ctx);    if (X == NULL) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    order = EC_GROUP_get0_order(group);    if (order == NULL) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);        goto err;    }    if (BN_is_zero(sig->r) || BN_is_negative(sig->r) ||        BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) ||        BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_BAD_SIGNATURE);        ret = 0;                /* signature is invalid */        goto err;    }    /* calculate tmp1 = inv(S) mod order */    if (!BN_mod_inverse(u2, sig->s, order, ctx)) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    /* digest -> m */    i = BN_num_bits(order);    /*     * Need to truncate digest if it is too long: first truncate whole bytes.     */    if (8 * dgst_len > i)        dgst_len = (i + 7) / 8;    if (!BN_bin2bn(dgst, dgst_len, m)) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    /* If still too long truncate remaining bits with a shift */    if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    /* u1 = m * tmp mod order */    if (!BN_mod_mul(u1, m, u2, order, ctx)) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    /* u2 = r * w mod q */    if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    if ((point = EC_POINT_new(group)) == NULL) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);        goto err;    }    if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);        goto err;    }    if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==        NID_X9_62_prime_field) {        if (!EC_POINT_get_affine_coordinates_GFp(group, point, X, NULL, ctx)) {            ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);            goto err;        }    }#ifndef OPENSSL_NO_EC2M    else {                      /* NID_X9_62_characteristic_two_field */        if (!EC_POINT_get_affine_coordinates_GF2m(group, point, X, NULL, ctx)) {            ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);            goto err;        }    }#endif    if (!BN_nnmod(u1, X, order, ctx)) {        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);        goto err;    }    /*  if the signature is correct u1 is equal to sig->r */    ret = (BN_ucmp(u1, sig->r) == 0); err:    BN_CTX_end(ctx);    BN_CTX_free(ctx);    EC_POINT_free(point);    return ret;}

BN_BLINDING *rsa_setup_blinding(RSA *rsa, BN_CTX *in_ctx) {    BIGNUM local_n;    BIGNUM *e, *n;    BN_CTX *ctx;    BN_BLINDING *ret = NULL;    BN_MONT_CTX *mont_ctx = NULL;    if (in_ctx == NULL) {        ctx = BN_CTX_new();        if (ctx == NULL) {            return 0;        }    } else {        ctx = in_ctx;    }    BN_CTX_start(ctx);    e = BN_CTX_get(ctx);    if (e == NULL) {        OPENSSL_PUT_ERROR(RSA, rsa_setup_blinding, ERR_R_MALLOC_FAILURE);        goto err;    }    if (rsa->e == NULL) {        e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);        if (e == NULL) {            OPENSSL_PUT_ERROR(RSA, rsa_setup_blinding, RSA_R_NO_PUBLIC_EXPONENT);            goto err;        }    } else {        e = rsa->e;    }    n = &local_n;    BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {        mont_ctx =            BN_MONT_CTX_set_locked(&rsa->_method_mod_n, &rsa->lock, rsa->n, ctx);        if (mont_ctx == NULL) {            goto err;        }    }    ret = BN_BLINDING_create_param(NULL, e, n, ctx, rsa->meth->bn_mod_exp,                                   mont_ctx);    if (ret == NULL) {        OPENSSL_PUT_ERROR(RSA, rsa_setup_blinding, ERR_R_BN_LIB);        goto err;    }err:    BN_CTX_end(ctx);    if (in_ctx == NULL) {        BN_CTX_free(ctx);    }    if (rsa->e == NULL) {        BN_free(e);    }    return ret;}

intdh_im_compute_key(PACE_CTX * ctx, const BUF_MEM * s, const BUF_MEM * in,        BN_CTX *bn_ctx){    int ret = 0;    BUF_MEM * x_mem = NULL;    BIGNUM * x_bn = NULL, *a = NULL, *p_1 = NULL, *q = NULL;    DH *static_key = NULL, *ephemeral_key = NULL;    check((ctx && in && ctx->ka_ctx), "Invalid arguments");    if (in->length < (size_t) EVP_CIPHER_key_length(ctx->ka_ctx->cipher)            || !ctx->static_key)        goto err;    BN_CTX_start(bn_ctx);    static_key = EVP_PKEY_get1_DH(ctx->static_key);    if (!static_key)        goto err;    /* Initialize ephemeral parameters with parameters from the static key */    ephemeral_key = DHparams_dup_with_q(static_key);    if (!ephemeral_key)        goto err;    /* Perform the actual mapping */    x_mem = cipher_no_pad(ctx->ka_ctx, NULL, in, s, 1);    if (!x_mem)        goto err;    x_bn = BN_bin2bn((unsigned char *) x_mem->data, x_mem->length, x_bn);    a = BN_CTX_get(bn_ctx);    q = DH_get_q(static_key, bn_ctx);    p_1 = BN_dup(static_key->p);    if (!x_bn || !a || !q || !p_1 ||            /* p_1 = p-1 */            !BN_sub_word(p_1, 1) ||            /* a = p-1 / q */            !BN_div(a, NULL, p_1, q, bn_ctx) ||            /* g~ = x^a mod p */            !BN_mod_exp(ephemeral_key->g, x_bn, a, static_key->p, bn_ctx))        goto err;    /* check if g~ != 1 */    check((!BN_is_one(ephemeral_key->g)), "Bad DH generator");    /* Copy ephemeral key to context structure */    if (!EVP_PKEY_set1_DH(ctx->ka_ctx->key, ephemeral_key))        goto err;    ret = 1;err:    if (q)        BN_clear_free(q);    if (p_1)        BN_clear_free(p_1);    if (x_bn)        BN_clear_free(x_bn);    if (x_mem)        BUF_MEM_free(x_mem);    /* Decrement reference count, keys are still available via PACE_CTX */    if (static_key)        DH_free(static_key);    if (ephemeral_key)        DH_free(ephemeral_key);    BN_CTX_end(bn_ctx);    return ret;}

/* Actually there is no reason to insist that 'generator' be a generator. * It's just as OK (and in some sense better) to use a generator of the * order-q subgroup. */DH *DH_generate_parameters(int prime_len, int generator,	     void (*callback)(int,int,void *), void *cb_arg)	{	BIGNUM *p=NULL,*t1,*t2;	DH *ret=NULL;	int g,ok= -1;	BN_CTX *ctx=NULL;	ret=DH_new();	if (ret == NULL) goto err;	ctx=BN_CTX_new();	if (ctx == NULL) goto err;	BN_CTX_start(ctx);	t1 = BN_CTX_get(ctx);	t2 = BN_CTX_get(ctx);	if (t1 == NULL || t2 == NULL) goto err;		if (generator <= 1)		goto err;	if (generator == DH_GENERATOR_2)		{		if (!BN_set_word(t1,24)) goto err;		if (!BN_set_word(t2,11)) goto err;		g=2;		}	else if (generator == DH_GENERATOR_5)		{		if (!BN_set_word(t1,10)) goto err;		if (!BN_set_word(t2,3)) goto err;		/* BN_set_word(t3,7); just have to miss		 * out on these ones :-( */		g=5;		}	else		{		/* in the general case, don't worry if 'generator' is a		 * generator or not: since we are using safe primes,		 * it will generate either an order-q or an order-2q group,		 * which both is OK */		if (!BN_set_word(t1,2)) goto err;		if (!BN_set_word(t2,1)) goto err;		g=generator;		}		p=BN_generate_prime(NULL,prime_len,1,t1,t2,callback,cb_arg);	if (p == NULL) goto err;	if (callback != NULL) callback(3,0,cb_arg);	ret->p=p;	ret->g=BN_new();	if (!BN_set_word(ret->g,g)) goto err;	ok=1;err:	if (ok == -1)		ok=0;	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	if (!ok && (ret != NULL))		{		DH_free(ret);		ret=NULL;		}	return(ret);	}

//.........这里部分代码省略.........  multiple = BN_CTX_get(ctx);  p_plus_q = BN_CTX_get(ctx);  p_minus_q = BN_CTX_get(ctx);  if (totient == NULL || rem == NULL || multiple == NULL || p_plus_q == NULL ||      p_minus_q == NULL) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, ERR_R_MALLOC_FAILURE);    goto err;  }  /* ed-1 is a small multiple of φ(n). */  if (!BN_mul(totient, rsa->e, rsa->d, ctx) ||      !BN_sub_word(totient, 1) ||      /* φ(n) =       * pq - p - q + 1 =       * n - (p + q) + 1       *       * Thus n is a reasonable estimate for φ(n). So, (ed-1)/n will be very       * close. But, when we calculate the quotient, we'll be truncating it       * because we discard the remainder. Thus (ed-1)/multiple will be >= n,       * which the totient cannot be. So we add one to the estimate.       *       * Consider ed-1 as:       *       * multiple * (n - (p+q) + 1) =       * multiple*n - multiple*(p+q) + multiple       *       * When we divide by n, the first term becomes multiple and, since       * multiple and p+q is tiny compared to n, the second and third terms can       * be ignored. Thus I claim that subtracting one from the estimate is       * sufficient. */      !BN_div(multiple, NULL, totient, rsa->n, ctx) ||      !BN_add_word(multiple, 1) ||      !BN_div(totient, rem, totient, multiple, ctx)) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, ERR_R_BN_LIB);    goto err;  }  if (!BN_is_zero(rem)) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, RSA_R_BAD_RSA_PARAMETERS);    goto err;  }  rsa->p = BN_new();  rsa->q = BN_new();  rsa->dmp1 = BN_new();  rsa->dmq1 = BN_new();  rsa->iqmp = BN_new();  if (rsa->p == NULL || rsa->q == NULL || rsa->dmp1 == NULL || rsa->dmq1 ==      NULL || rsa->iqmp == NULL) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, ERR_R_MALLOC_FAILURE);    goto err;  }  /* φ(n) = n - (p + q) + 1 =>   * n - totient + 1 = p + q */  if (!BN_sub(p_plus_q, rsa->n, totient) ||      !BN_add_word(p_plus_q, 1) ||      /* p - q = sqrt((p+q)^2 - 4n) */      !BN_sqr(rem, p_plus_q, ctx) ||      !BN_lshift(multiple, rsa->n, 2) ||      !BN_sub(rem, rem, multiple) ||      !BN_sqrt(p_minus_q, rem, ctx) ||      /* q is 1/2 (p+q)-(p-q) */      !BN_sub(rsa->q, p_plus_q, p_minus_q) ||      !BN_rshift1(rsa->q, rsa->q) ||      !BN_div(rsa->p, NULL, rsa->n, rsa->q, ctx) ||      !BN_mul(multiple, rsa->p, rsa->q, ctx)) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, ERR_R_BN_LIB);    goto err;  }  if (BN_cmp(multiple, rsa->n) != 0) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, RSA_R_INTERNAL_ERROR);    goto err;  }  if (!BN_sub(rem, rsa->p, BN_value_one()) ||      !BN_mod(rsa->dmp1, rsa->d, rem, ctx) ||      !BN_sub(rem, rsa->q, BN_value_one()) ||      !BN_mod(rsa->dmq1, rsa->d, rem, ctx) ||      !BN_mod_inverse(rsa->iqmp, rsa->q, rsa->p, ctx)) {    OPENSSL_PUT_ERROR(RSA, RSA_recover_crt_params, ERR_R_BN_LIB);    goto err;  }  ok = 1;err:  BN_CTX_end(ctx);  BN_CTX_free(ctx);  if (!ok) {    bn_free_and_null(&rsa->p);    bn_free_and_null(&rsa->q);    bn_free_and_null(&rsa->dmp1);    bn_free_and_null(&rsa->dmq1);    bn_free_and_null(&rsa->iqmp);  }  return ok;}

BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx){    BIGNUM local_n;    BIGNUM *e,*n;    BN_CTX *ctx;    BN_BLINDING *ret = NULL;    if (in_ctx == NULL)    {        if ((ctx = BN_CTX_new()) == NULL) return 0;    }    else        ctx = in_ctx;    BN_CTX_start(ctx);    e  = BN_CTX_get(ctx);    if (e == NULL)    {        RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_MALLOC_FAILURE);        goto err;    }    if (rsa->e == NULL)    {        e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);        if (e == NULL)        {            RSAerr(RSA_F_RSA_SETUP_BLINDING, RSA_R_NO_PUBLIC_EXPONENT);            goto err;        }    }    else        e = rsa->e;    if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)    {        /* if PRNG is not properly seeded, resort to secret         * exponent as unpredictable seed */        RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0.0);    }    if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))    {        /* Set BN_FLG_CONSTTIME flag */        n = &local_n;        BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);    }    else        n = rsa->n;    ret = BN_BLINDING_create_param(NULL, e, n, ctx,                                   rsa->meth->bn_mod_exp, rsa->_method_mod_n);    if (ret == NULL)    {        RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_BN_LIB);        goto err;    }    CRYPTO_THREADID_current(BN_BLINDING_thread_id(ret));err:    BN_CTX_end(ctx);    if (in_ctx == NULL)        BN_CTX_free(ctx);    if(rsa->e == NULL)        BN_free(e);    return ret;}

//.........这里部分代码省略.........    /* compute I mod p */    if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {        c = &local_c;        BN_with_flags(c, I, BN_FLG_CONSTTIME);        if (!BN_mod(r1, c, rsa->p, ctx))            goto err;    } else {        if (!BN_mod(r1, I, rsa->p, ctx))            goto err;    }    /* compute r1^dmp1 mod p */    if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {        dmp1 = &local_dmp1;        BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);    } else        dmp1 = rsa->dmp1;    if (!rsa->meth->bn_mod_exp(r0, r1, dmp1, rsa->p, ctx, rsa->_method_mod_p))        goto err;    if (!BN_sub(r0, r0, m1))        goto err;    /*     * This will help stop the size of r0 increasing, which does affect the     * multiply if it optimised for a power of 2 size     */    if (BN_is_negative(r0))        if (!BN_add(r0, r0, rsa->p))            goto err;    if (!BN_mul(r1, r0, rsa->iqmp, ctx))        goto err;    /* Turn BN_FLG_CONSTTIME flag on before division operation */    if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {        pr1 = &local_r1;        BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);    } else        pr1 = r1;    if (!BN_mod(r0, pr1, rsa->p, ctx))        goto err;    /*     * If p < q it is occasionally possible for the correction of adding 'p'     * if r0 is negative above to leave the result still negative. This can     * break the private key operations: the following second correction     * should *always* correct this rare occurrence. This will *never* happen     * with OpenSSL generated keys because they ensure p > q [steve]     */    if (BN_is_negative(r0))        if (!BN_add(r0, r0, rsa->p))            goto err;    if (!BN_mul(r1, r0, rsa->q, ctx))        goto err;    if (!BN_add(r0, r1, m1))        goto err;    if (rsa->e && rsa->n) {        if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,                                   rsa->_method_mod_n))            goto err;        /*         * If 'I' was greater than (or equal to) rsa->n, the operation will         * be equivalent to using 'I mod n'. However, the result of the         * verify will *always* be less than 'n' so we don't check for         * absolute equality, just congruency.         */        if (!BN_sub(vrfy, vrfy, I))            goto err;        if (!BN_mod(vrfy, vrfy, rsa->n, ctx))            goto err;        if (BN_is_negative(vrfy))            if (!BN_add(vrfy, vrfy, rsa->n))                goto err;        if (!BN_is_zero(vrfy)) {            /*             * 'I' and 'vrfy' aren't congruent mod n. Don't leak             * miscalculated CRT output, just do a raw (slower) mod_exp and             * return that instead.             */            BIGNUM local_d;            BIGNUM *d = NULL;            if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {                d = &local_d;                BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);            } else                d = rsa->d;            if (!rsa->meth->bn_mod_exp(r0, I, d, rsa->n, ctx,                                       rsa->_method_mod_n))                goto err;        }    }    ret = 1; err:    BN_CTX_end(ctx);    return (ret);}

/* signature verification */static int RSA_eay_public_decrypt(int flen, const unsigned char *from,                                  unsigned char *to, RSA *rsa, int padding){    BIGNUM *f, *ret;    int i, num = 0, r = -1;    unsigned char *p;    unsigned char *buf = NULL;    BN_CTX *ctx = NULL;    if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);        return -1;    }    if (BN_ucmp(rsa->n, rsa->e) <= 0) {        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);        return -1;    }    /* for large moduli, enforce exponent limit */    if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) {        if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {            RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);            return -1;        }    }    if ((ctx = BN_CTX_new()) == NULL)        goto err;    BN_CTX_start(ctx);    f = BN_CTX_get(ctx);    ret = BN_CTX_get(ctx);    num = BN_num_bytes(rsa->n);    buf = OPENSSL_malloc(num);    if (!f || !ret || !buf) {        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, ERR_R_MALLOC_FAILURE);        goto err;    }    /*     * This check was for equality but PGP does evil things and chops off the     * top '0' bytes     */    if (flen > num) {        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_DATA_GREATER_THAN_MOD_LEN);        goto err;    }    if (BN_bin2bn(from, flen, f) == NULL)        goto err;    if (BN_ucmp(f, rsa->n) >= 0) {        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);        goto err;    }    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)        if (!BN_MONT_CTX_set_locked            (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))            goto err;    if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx,                               rsa->_method_mod_n))        goto err;    if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))        if (!BN_sub(ret, rsa->n, ret))            goto err;    p = buf;    i = BN_bn2bin(ret, p);    switch (padding) {    case RSA_PKCS1_PADDING:        r = RSA_padding_check_PKCS1_type_1(to, num, buf, i, num);        break;    case RSA_X931_PADDING:        r = RSA_padding_check_X931(to, num, buf, i, num);        break;    case RSA_NO_PADDING:        r = RSA_padding_check_none(to, num, buf, i, num);        break;    default:        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);        goto err;    }    if (r < 0)        RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_PADDING_CHECK_FAILED); err:    if (ctx != NULL) {        BN_CTX_end(ctx);        BN_CTX_free(ctx);    }    if (buf != NULL) {        OPENSSL_cleanse(buf, num);        OPENSSL_free(buf);    }//.........这里部分代码省略.........

//.........这里部分代码省略.........  if (!BN_mod(r0, pr1, rsa->p, ctx)) {    goto err;  }  /* If p < q it is occasionally possible for the correction of   * adding 'p' if r0 is negative above to leave the result still   * negative. This can break the private key operations: the following   * second correction should *always* correct this rare occurrence.   * This will *never* happen with OpenSSL generated keys because   * they ensure p > q [steve] */  if (BN_is_negative(r0)) {    if (!BN_add(r0, r0, rsa->p)) {      goto err;    }  }  if (!BN_mul(r1, r0, rsa->q, ctx)) {    goto err;  }  if (!BN_add(r0, r1, m1)) {    goto err;  }  for (i = 0; i < num_additional_primes; i++) {    /* multi-prime RSA. */    BIGNUM local_exp, local_prime;    BIGNUM *exp = &local_exp, *prime = &local_prime;    RSA_additional_prime *ap =        sk_RSA_additional_prime_value(rsa->additional_primes, i);    BN_with_flags(exp, ap->exp, BN_FLG_CONSTTIME);    BN_with_flags(prime, ap->prime, BN_FLG_CONSTTIME);    /* c will already point to a BIGNUM with the correct flags. */    if (!BN_mod(r1, c, prime, ctx)) {      goto err;    }    if ((rsa->flags & RSA_FLAG_CACHE_PRIVATE) &&        !BN_MONT_CTX_set_locked(&ap->method_mod, &rsa->lock, prime, ctx)) {      goto err;    }    if (!rsa->meth->bn_mod_exp(m1, r1, exp, prime, ctx, ap->method_mod)) {      goto err;    }    BN_set_flags(m1, BN_FLG_CONSTTIME);    if (!BN_sub(m1, m1, r0) ||        !BN_mul(m1, m1, ap->coeff, ctx) ||        !BN_mod(m1, m1, prime, ctx) ||        (BN_is_negative(m1) && !BN_add(m1, m1, prime)) ||        !BN_mul(m1, m1, ap->r, ctx) ||        !BN_add(r0, r0, m1)) {      goto err;    }  }  if (rsa->e && rsa->n) {    if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,                               rsa->_method_mod_n)) {      goto err;    }    /* If 'I' was greater than (or equal to) rsa->n, the operation     * will be equivalent to using 'I mod n'. However, the result of     * the verify will *always* be less than 'n' so we don't check     * for absolute equality, just congruency. */    if (!BN_sub(vrfy, vrfy, I)) {      goto err;    }    if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) {      goto err;    }    if (BN_is_negative(vrfy)) {      if (!BN_add(vrfy, vrfy, rsa->n)) {        goto err;      }    }    if (!BN_is_zero(vrfy)) {      /* 'I' and 'vrfy' aren't congruent mod n. Don't leak       * miscalculated CRT output, just do a raw (slower)       * mod_exp and return that instead. */      BIGNUM local_d;      BIGNUM *d = NULL;      d = &local_d;      BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);      if (!rsa->meth->bn_mod_exp(r0, I, d, rsa->n, ctx, rsa->_method_mod_n)) {        goto err;      }    }  }  ret = 1;err:  BN_CTX_end(ctx);  return ret;}

intecdh_gm_compute_key(PACE_CTX * ctx, const BUF_MEM * s, const BUF_MEM * in,        BN_CTX *bn_ctx){    int ret = 0;    BUF_MEM * mem_h = NULL;    BIGNUM * bn_s = NULL, *order = NULL, *cofactor = NULL;    EC_POINT * ecp_h = NULL, *ecp_g = NULL;    const ECDH_METHOD *default_method;    EC_GROUP *group = NULL;    EC_KEY *static_key = NULL, *ephemeral_key = NULL;    BN_CTX_start(bn_ctx);    check((ctx && ctx->static_key && s && ctx->ka_ctx), "Invalid arguments");    static_key = EVP_PKEY_get1_EC_KEY(ctx->static_key);    check(static_key, "could not get key object");    /* Extract group parameters */    group = EC_GROUP_dup(EC_KEY_get0_group(static_key));    order = BN_CTX_get(bn_ctx);    cofactor = BN_CTX_get(bn_ctx);    check(group && cofactor, "internal error");    if (!EC_GROUP_get_order(group, order, bn_ctx)            || !EC_GROUP_get_cofactor(group, cofactor, bn_ctx))        goto err;    /* Convert nonce to BIGNUM */    bn_s = BN_bin2bn((unsigned char *) s->data, s->length, bn_s);    if (!bn_s)        goto err;    default_method = ECDH_get_default_method();    ECDH_set_default_method(ECDH_OpenSSL_Point());    /* complete the ECDH and get the resulting point h */    mem_h = ecdh_compute_key(ctx->static_key, in, bn_ctx);    ECDH_set_default_method(default_method);    ecp_h = EC_POINT_new(group);    if (!mem_h || !ecp_h || !EC_POINT_oct2point(group, ecp_h,            (unsigned char *) mem_h->data, mem_h->length, bn_ctx))        goto err;    /* map to new generator */    ecp_g = EC_POINT_new(group);    /* g' = g*s + h*1 */    if (!EC_POINT_mul(group, ecp_g, bn_s, ecp_h, BN_value_one(), bn_ctx))        goto err;    /* Initialize ephemeral parameters with parameters from the static key */    ephemeral_key = EC_KEY_dup(static_key);    if (!ephemeral_key)        goto err;    EVP_PKEY_set1_EC_KEY(ctx->ka_ctx->key, ephemeral_key);    /* configure the new EC_KEY */    if (!EC_GROUP_set_generator(group, ecp_g, order, cofactor)            || !EC_GROUP_check(group, bn_ctx)            || !EC_KEY_set_group(ephemeral_key, group))        goto err;    ret = 1;err:    if (ecp_g)        EC_POINT_clear_free(ecp_g);    if (ecp_h)        EC_POINT_clear_free(ecp_h);    if (mem_h)        BUF_MEM_free(mem_h);    if (bn_s)        BN_clear_free(bn_s);    BN_CTX_end(bn_ctx);    /* Decrement reference count, keys are still available via PACE_CTX */    if (static_key)        EC_KEY_free(static_key);    if (ephemeral_key)        EC_KEY_free(ephemeral_key);    if (group)        EC_GROUP_clear_free(group);    return ret;}

//.........这里部分代码省略.........    /* ap->r is is the product of all the primes prior to the current one     * (including p and q). */    if (!BN_copy(ap->r, rsa->n)) {      goto err;    }    if (i == num_primes - 1) {      /* In the case of the last prime, we calculated n as |r1| in the loop       * above. */      if (!BN_copy(rsa->n, r1)) {        goto err;      }    } else if (!BN_mul(rsa->n, rsa->n, ap->prime, ctx)) {      goto err;    }    if (!BN_GENCB_call(cb, 3, 1)) {      goto err;    }  }  if (BN_cmp(rsa->p, rsa->q) < 0) {    tmp = rsa->p;    rsa->p = rsa->q;    rsa->q = tmp;  }  /* calculate d */  if (!BN_sub(r1, rsa->p, BN_value_one())) {    goto err; /* p-1 */  }  if (!BN_sub(r2, rsa->q, BN_value_one())) {    goto err; /* q-1 */  }  if (!BN_mul(r0, r1, r2, ctx)) {    goto err; /* (p-1)(q-1) */  }  for (i = 2; i < num_primes; i++) {    RSA_additional_prime *ap =        sk_RSA_additional_prime_value(additional_primes, i - 2);    if (!BN_sub(r3, ap->prime, BN_value_one()) ||        !BN_mul(r0, r0, r3, ctx)) {      goto err;    }  }  pr0 = &local_r0;  BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);  if (!BN_mod_inverse(rsa->d, rsa->e, pr0, ctx)) {    goto err; /* d */  }  /* set up d for correct BN_FLG_CONSTTIME flag */  d = &local_d;  BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);  /* calculate d mod (p-1) */  if (!BN_mod(rsa->dmp1, d, r1, ctx)) {    goto err;  }  /* calculate d mod (q-1) */  if (!BN_mod(rsa->dmq1, d, r2, ctx)) {    goto err;  }  /* calculate inverse of q mod p */  p = &local_p;  BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);  if (!BN_mod_inverse(rsa->iqmp, rsa->q, p, ctx)) {    goto err;  }  for (i = 2; i < num_primes; i++) {    RSA_additional_prime *ap =        sk_RSA_additional_prime_value(additional_primes, i - 2);    if (!BN_sub(ap->exp, ap->prime, BN_value_one()) ||        !BN_mod(ap->exp, rsa->d, ap->exp, ctx) ||        !BN_mod_inverse(ap->coeff, ap->r, ap->prime, ctx)) {      goto err;    }  }  ok = 1;  rsa->additional_primes = additional_primes;  additional_primes = NULL;err:  if (ok == -1) {    OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);    ok = 0;  }  if (ctx != NULL) {    BN_CTX_end(ctx);    BN_CTX_free(ctx);  }  sk_RSA_additional_prime_pop_free(additional_primes,                                   RSA_additional_prime_free);  return ok;}

//.........这里部分代码省略.........    /* Fetch the curve parameters */    if (!EC_GROUP_get_curve_GFp(EC_KEY_get0_group(static_key), p, a, b, bn_ctx))        goto err;    /* Assign constants */    if (    !BN_set_word(two,2)||            !BN_set_word(three,3)||            !BN_set_word(four,4)||            !BN_set_word(six,6)||            !BN_set_word(twentyseven,27)            ) goto err;    /* Check prerequisites for curve parameters */    check(            /* p > 3;*/           (BN_cmp(p, three) == 1) &&           /* p mod 3 = 2; (p has the form p=q^n, q prime) */           BN_nnmod(tmp, p, three, bn_ctx) &&           (BN_cmp(tmp, two) == 0),        "Unsuited curve");    /* Convert encrypted nonce to BIGNUM */    u = BN_bin2bn((unsigned char *) x_mem->data, x_mem->length, u);    if (!u)        goto err;    if ( /* v = (3a - u^4) / 6u mod p */            !BN_mod_mul(tmp, three, a, p, bn_ctx) ||            !BN_mod_exp(tmp2, u, four, p, bn_ctx) ||            !BN_mod_sub(v, tmp, tmp2, p, bn_ctx) ||            !BN_mod_mul(tmp, u, six, p, bn_ctx) ||            /* For division within a galois field we need to compute             * the multiplicative inverse of a number */            !BN_mod_inverse(bn_inv, tmp, p, bn_ctx) ||            !BN_mod_mul(v, v, bn_inv, p, bn_ctx) ||            /* x = (v^2 - b - ((u^6)/27)) */            !BN_mod_sqr(tmp, v, p, bn_ctx) ||            !BN_mod_sub(tmp2, tmp, b, p, bn_ctx) ||            !BN_mod_exp(tmp, u, six, p, bn_ctx) ||            !BN_mod_inverse(bn_inv, twentyseven, p, bn_ctx) ||            !BN_mod_mul(tmp, tmp, bn_inv, p, bn_ctx) ||            !BN_mod_sub(x, tmp2, tmp, p, bn_ctx) ||            /* x -> x^(1/3) = x^((2p^n -1)/3) */            !BN_mul(tmp, two, p, bn_ctx) ||            !BN_sub(tmp, tmp, BN_value_one()) ||            /* Division is defined, because p^n = 2 mod 3 */            !BN_div(tmp, y, tmp, three, bn_ctx) ||            !BN_mod_exp(tmp2, x, tmp, p, bn_ctx) ||            !BN_copy(x, tmp2) ||            /* x += (u^2)/3 */            !BN_mod_sqr(tmp, u, p, bn_ctx) ||            !BN_mod_inverse(bn_inv, three, p, bn_ctx) ||            !BN_mod_mul(tmp2, tmp, bn_inv, p, bn_ctx) ||            !BN_mod_add(tmp, x, tmp2, p, bn_ctx) ||            !BN_copy(x, tmp) ||            /* y = ux + v */            !BN_mod_mul(y, u, x, p, bn_ctx) ||            !BN_mod_add(tmp, y, v, p, bn_ctx) ||            !BN_copy(y, tmp)            )        goto err;    /* Initialize ephemeral parameters with parameters from the static key */    ephemeral_key = EC_KEY_dup(static_key);    if (!ephemeral_key)        goto err;    EVP_PKEY_set1_EC_KEY(ctx->ka_ctx->key, ephemeral_key);    /* configure the new EC_KEY */    g = EC_POINT_new(EC_KEY_get0_group(ephemeral_key));    if (!g)        goto err;    if (!EC_POINT_set_affine_coordinates_GFp(EC_KEY_get0_group(ephemeral_key), g,            x, y, bn_ctx))        goto err;    ret = 1;err:    if (x_mem)        BUF_MEM_free(x_mem);    if (u)        BN_free(u);    BN_CTX_end(bn_ctx);    if (g)        EC_POINT_clear_free(g);    /* Decrement reference count, keys are still available via PACE_CTX */    if (static_key)        EC_KEY_free(static_key);    if (ephemeral_key)        EC_KEY_free(ephemeral_key);    return ret;}

// Perform ECDSA key recovery (see SEC1 4.1.6) for curves over (mod p)-fields// recid selects which key is recovered// if check is non-zero, additional checks are performedint ECDSA_SIG_recover_key_GFp(EC_KEY *eckey, ECDSA_SIG *ecsig, const unsigned char *msg, int msglen, int recid, int check){    if (!eckey) return 0;    int ret = 0;    BN_CTX *ctx = NULL;    BIGNUM *x = NULL;    BIGNUM *e = NULL;    BIGNUM *order = NULL;    BIGNUM *sor = NULL;    BIGNUM *eor = NULL;    BIGNUM *field = NULL;    EC_POINT *R = NULL;    EC_POINT *O = NULL;    EC_POINT *Q = NULL;    BIGNUM *rr = NULL;    BIGNUM *zero = NULL;    int n = 0;    int i = recid / 2;    const EC_GROUP *group = EC_KEY_get0_group(eckey);    if ((ctx = BN_CTX_new()) == NULL) { ret = -1; goto err; }    BN_CTX_start(ctx);    order = BN_CTX_get(ctx);    if (!EC_GROUP_get_order(group, order, ctx)) { ret = -2; goto err; }    x = BN_CTX_get(ctx);    if (!BN_copy(x, order)) { ret=-1; goto err; }    if (!BN_mul_word(x, i)) { ret=-1; goto err; }    if (!BN_add(x, x, ecsig->r)) { ret=-1; goto err; }    field = BN_CTX_get(ctx);    if (!EC_GROUP_get_curve_GFp(group, field, NULL, NULL, ctx)) { ret=-2; goto err; }    if (BN_cmp(x, field) >= 0) { ret=0; goto err; }    if ((R = EC_POINT_new(group)) == NULL) { ret = -2; goto err; }    if (!EC_POINT_set_compressed_coordinates_GFp(group, R, x, recid % 2, ctx)) { ret=0; goto err; }    if (check)    {        if ((O = EC_POINT_new(group)) == NULL) { ret = -2; goto err; }        if (!EC_POINT_mul(group, O, NULL, R, order, ctx)) { ret=-2; goto err; }        if (!EC_POINT_is_at_infinity(group, O)) { ret = 0; goto err; }    }    if ((Q = EC_POINT_new(group)) == NULL) { ret = -2; goto err; }    n = EC_GROUP_get_degree(group);    e = BN_CTX_get(ctx);    if (!BN_bin2bn(msg, msglen, e)) { ret=-1; goto err; }    if (8*msglen > n) BN_rshift(e, e, 8-(n & 7));    zero = BN_CTX_get(ctx);    if (!BN_zero(zero)) { ret=-1; goto err; }    if (!BN_mod_sub(e, zero, e, order, ctx)) { ret=-1; goto err; }    rr = BN_CTX_get(ctx);    if (!BN_mod_inverse(rr, ecsig->r, order, ctx)) { ret=-1; goto err; }    sor = BN_CTX_get(ctx);    if (!BN_mod_mul(sor, ecsig->s, rr, order, ctx)) { ret=-1; goto err; }    eor = BN_CTX_get(ctx);    if (!BN_mod_mul(eor, e, rr, order, ctx)) { ret=-1; goto err; }    if (!EC_POINT_mul(group, Q, eor, R, sor, ctx)) { ret=-2; goto err; }    if (!EC_KEY_set_public_key(eckey, Q)) { ret=-2; goto err; }    ret = 1;err:    if (ctx) {        BN_CTX_end(ctx);        BN_CTX_free(ctx);    }    if (R != NULL) EC_POINT_free(R);    if (O != NULL) EC_POINT_free(O);    if (Q != NULL) EC_POINT_free(Q);    return ret;}

intdh_gm_compute_key(PACE_CTX * ctx, const BUF_MEM * s, const BUF_MEM * in,        BN_CTX *bn_ctx){    int ret = 0;    BUF_MEM * mem_h = NULL;    BIGNUM * bn_s = NULL, *bn_h = NULL, *bn_g = NULL;    DH *static_key = NULL, *ephemeral_key = NULL;    check(ctx && ctx->static_key && s && ctx->ka_ctx, "Invalid arguments");    BN_CTX_start(bn_ctx);    static_key = EVP_PKEY_get1_DH(ctx->static_key);    if (!static_key)        goto err;    /* Convert nonce to BIGNUM */    bn_s = BN_bin2bn((unsigned char *) s->data, s->length, bn_s);    if (!bn_s)        goto err;    /* complete the DH and convert the result to a BIGNUM */    mem_h = dh_compute_key(ctx->static_key, in, bn_ctx);    if (!mem_h)        goto err;    bn_h = BN_bin2bn((unsigned char *) mem_h->data, mem_h->length, bn_h);    if (!bn_h)        goto err;    /* Initialize ephemeral parameters with parameters from the static key */    ephemeral_key = DHparams_dup_with_q(static_key);    if (!ephemeral_key)        goto err;    /* map to new generator */    bn_g = BN_CTX_get(bn_ctx);    if (!bn_g ||        /* bn_g = g^s mod p */        !BN_mod_exp(bn_g, static_key->g, bn_s, static_key->p, bn_ctx) ||        /* ephemeral_key->g = bn_g * h mod p = g^s * h mod p */        !BN_mod_mul(ephemeral_key->g, bn_g, bn_h, static_key->p, bn_ctx))        goto err;    /* Copy ephemeral key to context structure */    if (!EVP_PKEY_set1_DH(ctx->ka_ctx->key, ephemeral_key))        goto err;    ret = 1;err:    if (mem_h) {        OPENSSL_cleanse(mem_h->data, mem_h->max);        BUF_MEM_free(mem_h);    }    if (bn_h)        BN_clear_free(bn_h);    if (bn_s)        BN_clear_free(bn_s);    /* Decrement reference count, keys are still available via PACE_CTX */    if (static_key)        DH_free(static_key);    if (ephemeral_key)        DH_free(ephemeral_key);    BN_CTX_end(bn_ctx);    return ret;}

/* Compute the x, y affine coordinates from the point (x1, z1) (x2, z2) * using Montgomery point multiplication algorithm Mxy() in appendix of *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over *     GF(2^m) without precomputation" (CHES '99, LNCS 1717). * Returns: *     0 on error *     1 if return value should be the point at infinity *     2 otherwise */static int gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIGNUM *x1,    BIGNUM *z1, BIGNUM *x2, BIGNUM *z2, BN_CTX *ctx){	BIGNUM *t3, *t4, *t5;	int ret = 0;	if (BN_is_zero(z1)) {		BN_zero(x2);		BN_zero(z2);		return 1;	}	if (BN_is_zero(z2)) {		if (!BN_copy(x2, x))			return 0;		if (!BN_GF2m_add(z2, x, y))			return 0;		return 2;	}	/* Since Mxy is static we can guarantee that ctx != NULL. */	BN_CTX_start(ctx);	if ((t3 = BN_CTX_get(ctx)) == NULL)		goto err;	if ((t4 = BN_CTX_get(ctx)) == NULL)		goto err;	if ((t5 = BN_CTX_get(ctx)) == NULL)		goto err;	if (!BN_one(t5))		goto err;	if (!group->meth->field_mul(group, t3, z1, z2, ctx))		goto err;	if (!group->meth->field_mul(group, z1, z1, x, ctx))		goto err;	if (!BN_GF2m_add(z1, z1, x1))		goto err;	if (!group->meth->field_mul(group, z2, z2, x, ctx))		goto err;	if (!group->meth->field_mul(group, x1, z2, x1, ctx))		goto err;	if (!BN_GF2m_add(z2, z2, x2))		goto err;	if (!group->meth->field_mul(group, z2, z2, z1, ctx))		goto err;	if (!group->meth->field_sqr(group, t4, x, ctx))		goto err;	if (!BN_GF2m_add(t4, t4, y))		goto err;	if (!group->meth->field_mul(group, t4, t4, t3, ctx))		goto err;	if (!BN_GF2m_add(t4, t4, z2))		goto err;	if (!group->meth->field_mul(group, t3, t3, x, ctx))		goto err;	if (!group->meth->field_div(group, t3, t5, t3, ctx))		goto err;	if (!group->meth->field_mul(group, t4, t3, t4, ctx))		goto err;	if (!group->meth->field_mul(group, x2, x1, t3, ctx))		goto err;	if (!BN_GF2m_add(z2, x2, x))		goto err;	if (!group->meth->field_mul(group, z2, z2, t4, ctx))		goto err;	if (!BN_GF2m_add(z2, z2, y))		goto err;	ret = 2;err:	BN_CTX_end(ctx);	return ret;}

/* Actually there is no reason to insist that 'generator' be a generator. * It's just as OK (and in some sense better) to use a generator of the * order-q subgroup. */static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)	{	BIGNUM *t1,*t2;	int g,ok= -1;	BN_CTX *ctx=NULL;	ctx=BN_CTX_new();	if (ctx == NULL) goto err;	BN_CTX_start(ctx);	t1 = BN_CTX_get(ctx);	t2 = BN_CTX_get(ctx);	if (t1 == NULL || t2 == NULL) goto err;	/* Make sure 'ret' has the necessary elements */	if(!ret->p && ((ret->p = BN_new()) == NULL)) goto err;	if(!ret->g && ((ret->g = BN_new()) == NULL)) goto err;		if (generator <= 1)		{/*Begin: comment out , 17Aug2006, Chris */#if 0		DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);#endif/*End: comment out , 17Aug2006, Chris */		goto err;		}	if (generator == DH_GENERATOR_2)		{		if (!BN_set_word(t1,24)) goto err;		if (!BN_set_word(t2,11)) goto err;		g=2;		}#if 0 /* does not work for safe primes */	else if (generator == DH_GENERATOR_3)		{		if (!BN_set_word(t1,12)) goto err;		if (!BN_set_word(t2,5)) goto err;		g=3;		}#endif	else if (generator == DH_GENERATOR_5)		{		if (!BN_set_word(t1,10)) goto err;		if (!BN_set_word(t2,3)) goto err;		/* BN_set_word(t3,7); just have to miss		 * out on these ones :-( */		g=5;		}	else		{		/* in the general case, don't worry if 'generator' is a		 * generator or not: since we are using safe primes,		 * it will generate either an order-q or an order-2q group,		 * which both is OK */		if (!BN_set_word(t1,2)) goto err;		if (!BN_set_word(t2,1)) goto err;		g=generator;		}		if(prime_len==3072)		get_rfc3526_prime_3072(ret->p);	else		if(!BN_generate_prime_ex(ret->p,prime_len,1,t1,t2,cb)) goto err;	if(!BN_GENCB_call(cb, 3, 0)) goto err;	if (!BN_set_word(ret->g,g)) goto err;	ok=1;err:	if (ok == -1)		{/*Begin: comment out , 17Aug2006, Chris */#if 0		DHerr(DH_F_DH_BUILTIN_GENPARAMS,ERR_R_BN_LIB);#endif/*End: comment out , 17Aug2006, Chris */		ok=0;		}	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	return ok;	}

int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) {  int ret = 0;  BIGNUM *Ri, *R;  BIGNUM tmod;  BN_ULONG buf[2];  if (BN_is_zero(mod)) {    OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO);    return 0;  }  BN_CTX_start(ctx);  Ri = BN_CTX_get(ctx);  if (Ri == NULL) {    goto err;  }  R = &mont->RR; /* grab RR as a temp */  if (!BN_copy(&mont->N, mod)) {    goto err; /* Set N */  }  mont->N.neg = 0;  BN_init(&tmod);  tmod.d = buf;  tmod.dmax = 2;  tmod.neg = 0;  BN_zero(R);  if (!BN_set_bit(R, BN_MONT_CTX_N0_LIMBS * BN_BITS2)) {    goto err;  }  tmod.top = 0;  buf[0] = mod->d[0];  if (buf[0] != 0) {    tmod.top = 1;  }  buf[1] = 0;  if (BN_MONT_CTX_N0_LIMBS == 2 && mod->top > 1 && mod->d[1] != 0) {    buf[1] = mod->d[1];    tmod.top = 2;  }  if (BN_mod_inverse(Ri, R, &tmod, ctx) == NULL) {    goto err;  }  if (!BN_lshift(Ri, Ri, BN_MONT_CTX_N0_LIMBS * BN_BITS2)) {    goto err; /* R*Ri */  }  const BIGNUM *Ri_dividend;  if (!BN_is_zero(Ri)) {    if (!BN_sub_word(Ri, 1)) {      goto err;    }    Ri_dividend = Ri;  } else {    /* Ri == 0 so Ri - 1 == -1. -1 % tmod == 0xff..ff. */    static const BN_ULONG kMinusOneLimbs[BN_MONT_CTX_N0_LIMBS] = {      BN_MASK2,#if BN_MONT_CTX_N0_LIMBS == 2      BN_MASK2#endif    };    STATIC_BIGNUM_DIAGNOSTIC_PUSH    static const BIGNUM kMinusOne = STATIC_BIGNUM(kMinusOneLimbs);    STATIC_BIGNUM_DIAGNOSTIC_POP    Ri_dividend = &kMinusOne;  }  if (!BN_div(Ri, NULL, Ri_dividend, &tmod, ctx)) {    goto err;  }  mont->n0[0] = 0;  if (Ri->top > 0) {    mont->n0[0] = Ri->d[0];  }  mont->n0[1] = 0;  if (BN_MONT_CTX_N0_LIMBS == 2 && Ri->top > 1) {    mont->n0[1] = Ri->d[1];  }  /* RR = (2^ri)^2 == 2^(ri*2) == 1 << (ri*2), which has its (ri*2)th bit set. */  int ri = (BN_num_bits(mod) + (BN_BITS2 - 1)) / BN_BITS2 * BN_BITS2;  BN_zero(&(mont->RR));  if (!BN_set_bit(&(mont->RR), ri * 2)) {    goto err;  }  if (!BN_mod(&(mont->RR), &(mont->RR), &(mont->N), ctx)) {    goto err;  }  ret = 1;err:  BN_CTX_end(ctx);  return ret;}

//.........这里部分代码省略.........				callback(0,counter,cb_arg);			/* step 7 */			BN_zero(W);			/* now 'buf' contains "SEED + offset - 1" */			for (k=0; k<=n; k++)				{				/* obtain "SEED + offset + k" by incrementing: */				for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)					{					buf[i]++;					if (buf[i] != 0) break;					}				EVP_Digest(buf,SHA_DIGEST_LENGTH,md,NULL,HASH, NULL);				/* step 8 */				if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0))					goto err;				BN_lshift(r0,r0,160*k);				BN_add(W,W,r0);				}			/* more of step 8 */			BN_mask_bits(W,bits-1);			BN_copy(X,W); /* this should be ok */			BN_add(X,X,test); /* this should be ok */			/* step 9 */			BN_lshift1(r0,q);			BN_mod(c,X,r0,ctx);			BN_sub(r0,c,BN_value_one());			BN_sub(p,X,r0);			/* step 10 */			if (BN_cmp(p,test) >= 0)				{				/* step 11 */				r = BN_is_prime_fasttest(p, DSS_prime_checks, callback, ctx3, cb_arg, 1);				if (r > 0)						goto end; /* found it */				if (r != 0)					goto err;				}			/* step 13 */			counter++;			/* "offset = offset + n + 1" */			/* step 14 */			if (counter >= 4096) break;			}		}end:	if (callback != NULL) callback(2,1,cb_arg);	/* We now need to generate g */	/* Set r0=(p-1)/q */	BN_sub(test,p,BN_value_one());	BN_div(r0,NULL,test,q,ctx);	BN_set_word(test,h);	BN_MONT_CTX_set(mont,p,ctx);	for (;;)		{		/* g=test^r0%p */		BN_mod_exp_mont(g,test,r0,p,ctx,mont);		if (!BN_is_one(g)) break;		BN_add(test,test,BN_value_one());		h++;		}	if (callback != NULL) callback(3,1,cb_arg);	ok=1;err:	if (!ok)		{		if (ret != NULL) DSA_free(ret);		}	else		{		ret->p=BN_dup(p);		ret->q=BN_dup(q);		ret->g=BN_dup(g);		if(seed_out != NULL) memcpy(seed_out,seed,20);		if (counter_ret != NULL) *counter_ret=counter;		if (h_ret != NULL) *h_ret=h;		}	if (ctx != NULL) BN_CTX_free(ctx);	if (ctx2 != NULL)		{		BN_CTX_end(ctx2);		BN_CTX_free(ctx2);		}	if (ctx3 != NULL) BN_CTX_free(ctx3);	if (mont != NULL) BN_MONT_CTX_free(mont);	return(ok?ret:NULL);	}

//.........这里部分代码省略.........    int ret = -1;    if (EC_POINT_is_at_infinity (group, point))        return 1;    field_mul = group->meth->field_mul;    field_sqr = group->meth->field_sqr;    p = &group->field;    if (ctx == NULL)    {        ctx = new_ctx = BN_CTX_new ();        if (ctx == NULL)            return -1;    }    BN_CTX_start (ctx);    rh = BN_CTX_get (ctx);    tmp = BN_CTX_get (ctx);    Z4 = BN_CTX_get (ctx);    Z6 = BN_CTX_get (ctx);    if (Z6 == NULL)        goto err;    /* We have a curve defined by a Weierstrass equation     *      y^2 = x^3 + a*x + b.     * The point to consider is given in Jacobian projective coordinates     * where  (X, Y, Z)  represents  (x, y) = (X/Z^2, Y/Z^3).     * Substituting this and multiplying by  Z^6  transforms the above equation into     *      Y^2 = X^3 + a*X*Z^4 + b*Z^6.     * To test this, we add up the right-hand side in 'rh'.     */    /* rh := X^2 */    if (!field_sqr (group, rh, &point->X, ctx))        goto err;    if (!point->Z_is_one)    {        if (!field_sqr (group, tmp, &point->Z, ctx))            goto err;        if (!field_sqr (group, Z4, tmp, ctx))            goto err;        if (!field_mul (group, Z6, Z4, tmp, ctx))            goto err;        /* rh := (rh + a*Z^4)*X */        if (group->a_is_minus3)        {            if (!BN_mod_lshift1_quick (tmp, Z4, p))                goto err;            if (!BN_mod_add_quick (tmp, tmp, Z4, p))                goto err;            if (!BN_mod_sub_quick (rh, rh, tmp, p))                goto err;            if (!field_mul (group, rh, rh, &point->X, ctx))                goto err;        }        else        {            if (!field_mul (group, tmp, Z4, &group->a, ctx))                goto err;            if (!BN_mod_add_quick (rh, rh, tmp, p))                goto err;            if (!field_mul (group, rh, rh, &point->X, ctx))                goto err;        }        /* rh := rh + b*Z^6 */        if (!field_mul (group, tmp, &group->b, Z6, ctx))            goto err;        if (!BN_mod_add_quick (rh, rh, tmp, p))            goto err;    }    else    {        /* point->Z_is_one */        /* rh := (rh + a)*X */        if (!BN_mod_add_quick (rh, rh, &group->a, p))            goto err;        if (!field_mul (group, rh, rh, &point->X, ctx))            goto err;        /* rh := rh + b */        if (!BN_mod_add_quick (rh, rh, &group->b, p))            goto err;    }    /* 'lh' := Y^2 */    if (!field_sqr (group, tmp, &point->Y, ctx))        goto err;    ret = (0 == BN_ucmp (tmp, rh));  err:    BN_CTX_end (ctx);    if (new_ctx != NULL)        BN_CTX_free (new_ctx);    return ret;}

//.........这里部分代码省略.........    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  if (max_out < rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);    return 0;  }  /* for large moduli, enforce exponent limit */  if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS &&      BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  if (padding == RSA_NO_PADDING) {    buf = out;  } else {    /* Allocate a temporary buffer to hold the padded plaintext. */    buf = OPENSSL_malloc(rsa_size);    if (buf == NULL) {      OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);      goto err;    }  }  if (!f || !result) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (in_len != rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_LEN_NOT_EQUAL_TO_MOD_LEN);    goto err;  }  if (BN_bin2bn(in, in_len, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {    if (BN_MONT_CTX_set_locked(&rsa->_method_mod_n, &rsa->lock, rsa->n, ctx) ==        NULL) {      goto err;    }  }  if (!rsa->meth->bn_mod_exp(result, f, rsa->e, rsa->n, ctx,                             rsa->_method_mod_n)) {    goto err;  }  if (!BN_bn2bin_padded(buf, rsa_size, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  switch (padding) {    case RSA_PKCS1_PADDING:      r = RSA_padding_check_PKCS1_type_1(out, rsa_size, buf, rsa_size);      break;    case RSA_NO_PADDING:      r = rsa_size;      break;    default:      OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE);      goto err;  }  if (r < 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_PADDING_CHECK_FAILED);  } else {    *out_len = r;    ret = 1;  }err:  if (ctx != NULL) {    BN_CTX_end(ctx);    BN_CTX_free(ctx);  }  if (padding != RSA_NO_PADDING && buf != NULL) {    OPENSSL_cleanse(buf, rsa_size);    OPENSSL_free(buf);  }  return ret;}

//.........这里部分代码省略.........        }    }    /* Now use a single explicit inversion to replace every     * non-zero points[i]->Z by its inverse. */    if (!BN_mod_inverse (tmp, prod_Z[num - 1], &group->field, ctx))    {        ECerr (EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE, ERR_R_BN_LIB);        goto err;    }    if (group->meth->field_encode != 0)    {        /* In the Montgomery case, we just turned  R*H  (representing H)         * into  1/(R*H),  but we need  R*(1/H)  (representing 1/H);         * i.e. we need to multiply by the Montgomery factor twice. */        if (!group->meth->field_encode (group, tmp, tmp, ctx))            goto err;        if (!group->meth->field_encode (group, tmp, tmp, ctx))            goto err;    }    for (i = num - 1; i > 0; --i)    {        /* Loop invariant: tmp is the product of the inverses of         * points[0]->Z .. points[i]->Z (zero-valued inputs skipped). */        if (!BN_is_zero (&points[i]->Z))        {            /* Set tmp_Z to the inverse of points[i]->Z (as product             * of Z inverses 0 .. i, Z values 0 .. i - 1). */            if (!group->meth->field_mul (group, tmp_Z, prod_Z[i - 1], tmp, ctx))                goto err;            /* Update tmp to satisfy the loop invariant for i - 1. */            if (!group->meth->field_mul (group, tmp, tmp, &points[i]->Z, ctx))                goto err;            /* Replace points[i]->Z by its inverse. */            if (!BN_copy (&points[i]->Z, tmp_Z))                goto err;        }    }    if (!BN_is_zero (&points[0]->Z))    {        /* Replace points[0]->Z by its inverse. */        if (!BN_copy (&points[0]->Z, tmp))            goto err;    }    /* Finally, fix up the X and Y coordinates for all points. */    for (i = 0; i < num; i++)    {        EC_POINT *p = points[i];        if (!BN_is_zero (&p->Z))        {            /* turn  (X, Y, 1/Z)  into  (X/Z^2, Y/Z^3, 1) */            if (!group->meth->field_sqr (group, tmp, &p->Z, ctx))                goto err;            if (!group->meth->field_mul (group, &p->X, &p->X, tmp, ctx))                goto err;            if (!group->meth->field_mul (group, tmp, tmp, &p->Z, ctx))                goto err;            if (!group->meth->field_mul (group, &p->Y, &p->Y, tmp, ctx))                goto err;            if (group->meth->field_set_to_one != 0)            {                if (!group->meth->field_set_to_one (group, &p->Z, ctx))                    goto err;            }            else            {                if (!BN_one (&p->Z))                    goto err;            }            p->Z_is_one = 1;        }    }    ret = 1;  err:    BN_CTX_end (ctx);    if (new_ctx != NULL)        BN_CTX_free (new_ctx);    if (prod_Z != NULL)    {        for (i = 0; i < num; i++)        {            if (prod_Z[i] == NULL)                break;            BN_clear_free (prod_Z[i]);        }        OPENSSL_free (prod_Z);    }    return ret;}

static int private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,                             size_t len) {  BIGNUM *f, *result;  BN_CTX *ctx = NULL;  unsigned blinding_index = 0;  BN_BLINDING *blinding = NULL;  int ret = 0;  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  if (f == NULL || result == NULL) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (BN_bin2bn(in, len, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    /* Usually the padding functions would catch this. */    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {    blinding = rsa_blinding_get(rsa, &blinding_index, ctx);    if (blinding == NULL) {      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);      goto err;    }    if (!BN_BLINDING_convert_ex(f, NULL, blinding, ctx)) {      goto err;    }  }  if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||      ((rsa->p != NULL) && (rsa->q != NULL) && (rsa->dmp1 != NULL) &&       (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {    if (!rsa->meth->mod_exp(result, f, rsa, ctx)) {      goto err;    }  } else {    BIGNUM local_d;    BIGNUM *d = NULL;    BN_init(&local_d);    d = &local_d;    BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {      if (BN_MONT_CTX_set_locked(&rsa->_method_mod_n, &rsa->lock, rsa->n,                                 ctx) == NULL) {        goto err;      }    }    if (!rsa->meth->bn_mod_exp(result, f, d, rsa->n, ctx, rsa->_method_mod_n)) {      goto err;    }  }  if (blinding) {    if (!BN_BLINDING_invert_ex(result, NULL, blinding, ctx)) {      goto err;    }  }  if (!BN_bn2bin_padded(out, len, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  ret = 1;err:  if (ctx != NULL) {    BN_CTX_end(ctx);    BN_CTX_free(ctx);  }  if (blinding != NULL) {    rsa_blinding_release(rsa, blinding, blinding_index);  }  return ret;}

int ec_GFp_simple_group_check_discriminant (const EC_GROUP * group, BN_CTX * ctx){    int ret = 0;    BIGNUM *a, *b, *order, *tmp_1, *tmp_2;    const BIGNUM *p = &group->field;    BN_CTX *new_ctx = NULL;    if (ctx == NULL)    {        ctx = new_ctx = BN_CTX_new ();        if (ctx == NULL)        {            ECerr (EC_F_EC_GFP_SIMPLE_GROUP_CHECK_DISCRIMINANT, ERR_R_MALLOC_FAILURE);            goto err;        }    }    BN_CTX_start (ctx);    a = BN_CTX_get (ctx);    b = BN_CTX_get (ctx);    tmp_1 = BN_CTX_get (ctx);    tmp_2 = BN_CTX_get (ctx);    order = BN_CTX_get (ctx);    if (order == NULL)        goto err;    if (group->meth->field_decode)    {        if (!group->meth->field_decode (group, a, &group->a, ctx))            goto err;        if (!group->meth->field_decode (group, b, &group->b, ctx))            goto err;    }    else    {        if (!BN_copy (a, &group->a))            goto err;        if (!BN_copy (b, &group->b))            goto err;    }    /* check the discriminant:     * y^2 = x^3 + a*x + b is an elliptic curve <=> 4*a^3 + 27*b^2 != 0 (mod p)      * 0 =< a, b < p */    if (BN_is_zero (a))    {        if (BN_is_zero (b))            goto err;    }    else if (!BN_is_zero (b))    {        if (!BN_mod_sqr (tmp_1, a, p, ctx))            goto err;        if (!BN_mod_mul (tmp_2, tmp_1, a, p, ctx))            goto err;        if (!BN_lshift (tmp_1, tmp_2, 2))            goto err;        /* tmp_1 = 4*a^3 */        if (!BN_mod_sqr (tmp_2, b, p, ctx))            goto err;        if (!BN_mul_word (tmp_2, 27))            goto err;        /* tmp_2 = 27*b^2 */        if (!BN_mod_add (a, tmp_1, tmp_2, p, ctx))            goto err;        if (BN_is_zero (a))            goto err;    }    ret = 1;  err:    if (ctx != NULL)        BN_CTX_end (ctx);    if (new_ctx != NULL)        BN_CTX_free (new_ctx);    return ret;}

//.........这里部分代码省略.........        break;    case RSA_NO_PADDING:        i = RSA_padding_add_none(buf, num, from, flen);        break;    case RSA_SSLV23_PADDING:    default:        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);        goto err;    }    if (i <= 0)        goto err;    if (BN_bin2bn(buf, num, f) == NULL)        goto err;    if (BN_ucmp(f, rsa->n) >= 0) {        /* usually the padding functions would catch this */        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);        goto err;    }    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);        if (blinding == NULL) {            RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);            goto err;        }    }    if (blinding != NULL) {        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {            RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);            goto err;        }        if (!rsa_blinding_convert(blinding, f, unblind, ctx))            goto err;    }    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||        ((rsa->p != NULL) &&         (rsa->q != NULL) &&         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))            goto err;    } else {        BIGNUM local_d;        BIGNUM *d = NULL;        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {            BN_init(&local_d);            d = &local_d;            BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);        } else            d = rsa->d;        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)            if (!BN_MONT_CTX_set_locked                (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))                goto err;        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,                                   rsa->_method_mod_n))            goto err;    }    if (blinding)        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))            goto err;    if (padding == RSA_X931_PADDING) {        BN_sub(f, rsa->n, ret);        if (BN_cmp(ret, f) > 0)            res = f;        else            res = ret;    } else        res = ret;    /*     * put in leading 0 bytes if the number is less than the length of the     * modulus     */    j = BN_num_bytes(res);    i = BN_bn2bin(res, &(to[num - j]));    for (k = 0; k < (num - i); k++)        to[k] = 0;    r = num; err:    if (ctx != NULL) {        BN_CTX_end(ctx);        BN_CTX_free(ctx);    }    if (buf != NULL) {        OPENSSL_cleanse(buf, num);        OPENSSL_free(buf);    }    return (r);}