自学教程：C++ BN_MONT_CTX_set_locked函数代码示例

BN_BLINDING *rsa_setup_blinding(RSA *rsa, BN_CTX *in_ctx) {  BIGNUM local_n;  BIGNUM *e, *n;  BN_CTX *ctx;  BN_BLINDING *ret = NULL;  BN_MONT_CTX *mont_ctx = NULL;  if (in_ctx == NULL) {    ctx = BN_CTX_new();    if (ctx == NULL) {      return 0;    }  } else {    ctx = in_ctx;  }  BN_CTX_start(ctx);  e = BN_CTX_get(ctx);  if (e == NULL) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (rsa->e == NULL) {    e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);    if (e == NULL) {      OPENSSL_PUT_ERROR(RSA, RSA_R_NO_PUBLIC_EXPONENT);      goto err;    }  } else {    e = rsa->e;  }  n = &local_n;  BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);  if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {    mont_ctx = BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx);    if (mont_ctx == NULL) {      goto err;    }  }  ret = BN_BLINDING_create_param(NULL, e, n, ctx, mont_ctx);  if (ret == NULL) {    OPENSSL_PUT_ERROR(RSA, ERR_R_BN_LIB);    goto err;  }err:  BN_CTX_end(ctx);  if (in_ctx == NULL) {    BN_CTX_free(ctx);  }  if (rsa->e == NULL) {    BN_free(e);  }  return ret;}

static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)	{	BN_CTX *ctx=NULL;	BN_MONT_CTX *mont=NULL;	BIGNUM *tmp;	int ret= -1;        int check_result;	if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)		{		DHerr(DH_F_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);		goto err;		}	ctx = BN_CTX_new();	if (ctx == NULL) goto err;	BN_CTX_start(ctx);	tmp = BN_CTX_get(ctx);		if (dh->priv_key == NULL)		{		DHerr(DH_F_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);		goto err;		}	if (dh->flags & DH_FLAG_CACHE_MONT_P)		{		mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,				CRYPTO_LOCK_DH, dh->p, ctx);		if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)			{			/* XXX */			BN_set_flags(dh->priv_key, BN_FLG_EXP_CONSTTIME);			}		if (!mont)			goto err;		}        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result)		{		DHerr(DH_F_COMPUTE_KEY,DH_R_INVALID_PUBKEY);		goto err;		}	if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key,dh->p,ctx,mont))		{		DHerr(DH_F_COMPUTE_KEY,ERR_R_BN_LIB);		goto err;		}	ret=BN_bn2bin(tmp,key);err:	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	return(ret);	}

int DH_compute_key(unsigned char *out, const BIGNUM *peers_key, DH *dh) {  BN_CTX *ctx = NULL;  BIGNUM *shared_key;  int ret = -1;  int check_result;  if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {    OPENSSL_PUT_ERROR(DH, DH_R_MODULUS_TOO_LARGE);    goto err;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  shared_key = BN_CTX_get(ctx);  if (shared_key == NULL) {    goto err;  }  if (dh->priv_key == NULL) {    OPENSSL_PUT_ERROR(DH, DH_R_NO_PRIVATE_VALUE);    goto err;  }  if (!BN_MONT_CTX_set_locked(&dh->method_mont_p, &dh->method_mont_p_lock,                              dh->p, ctx)) {    goto err;  }  if (!DH_check_pub_key(dh, peers_key, &check_result) || check_result) {    OPENSSL_PUT_ERROR(DH, DH_R_INVALID_PUBKEY);    goto err;  }  if (!BN_mod_exp_mont_consttime(shared_key, peers_key, dh->priv_key, dh->p,                                 ctx, dh->method_mont_p)) {    OPENSSL_PUT_ERROR(DH, ERR_R_BN_LIB);    goto err;  }  ret = BN_bn2bin(shared_key, out);err:  if (ctx != NULL) {    BN_CTX_end(ctx);    BN_CTX_free(ctx);  }  return ret;}

static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)	{	BN_CTX *ctx;	BN_MONT_CTX *mont=NULL;	BIGNUM *tmp;	int ret= -1;	ctx = BN_CTX_new();	if (ctx == NULL) goto err;	BN_CTX_start(ctx);	tmp = BN_CTX_get(ctx);		if (dh->priv_key == NULL)		{		DHerr(DH_F_DH_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);		goto err;		}	if (dh->flags & DH_FLAG_CACHE_MONT_P)		{		mont = BN_MONT_CTX_set_locked(				(BN_MONT_CTX **)&dh->method_mont_p,				CRYPTO_LOCK_DH, dh->p, ctx);		if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)			{			/* XXX */			BN_set_flags(dh->priv_key, BN_FLG_EXP_CONSTTIME);			}		if (!mont)			goto err;		}	if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key,dh->p,ctx,mont))		{		DHerr(DH_F_DH_COMPUTE_KEY,ERR_R_BN_LIB);		goto err;		}	ret=BN_bn2bin(tmp,key);err:	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	return(ret);	}

static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,                                  unsigned char *to, RSA *rsa, int padding){    BIGNUM *f, *ret;    int i, num = 0, r = -1;    unsigned char *buf = NULL;    BN_CTX *ctx = NULL;    if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);        return -1;    }    if (BN_ucmp(rsa->n, rsa->e) <= 0) {        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);        return -1;    }    /* for large moduli, enforce exponent limit */    if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) {        if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {            RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);            return -1;        }    }    if ((ctx = BN_CTX_new()) == NULL)        goto err;    BN_CTX_start(ctx);    f = BN_CTX_get(ctx);    ret = BN_CTX_get(ctx);    num = BN_num_bytes(rsa->n);    buf = OPENSSL_malloc(num);    if (ret == NULL || buf == NULL) {        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, ERR_R_MALLOC_FAILURE);        goto err;    }    switch (padding) {    case RSA_PKCS1_PADDING:        i = RSA_padding_add_PKCS1_type_2(buf, num, from, flen);        break;    case RSA_PKCS1_OAEP_PADDING:        i = RSA_padding_add_PKCS1_OAEP(buf, num, from, flen, NULL, 0);        break;    case RSA_SSLV23_PADDING:        i = RSA_padding_add_SSLv23(buf, num, from, flen);        break;    case RSA_NO_PADDING:        i = RSA_padding_add_none(buf, num, from, flen);        break;    default:        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);        goto err;    }    if (i <= 0)        goto err;    if (BN_bin2bn(buf, num, f) == NULL)        goto err;    if (BN_ucmp(f, rsa->n) >= 0) {        /* usually the padding functions would catch this */        RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT,               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);        goto err;    }    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,                                    rsa->n, ctx))            goto err;    if (!rsa->meth->bn_mod_exp(ret, f, rsa->e, rsa->n, ctx,                               rsa->_method_mod_n))        goto err;    /*     * BN_bn2binpad puts in leading 0 bytes if the number is less than     * the length of the modulus.     */    r = BN_bn2binpad(ret, to, num); err:    if (ctx != NULL)        BN_CTX_end(ctx);    BN_CTX_free(ctx);    OPENSSL_clear_free(buf, num);    return r;}

static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {  assert(ctx != NULL);  assert(rsa->n != NULL);  assert(rsa->e != NULL);  assert(rsa->d != NULL);  assert(rsa->p != NULL);  assert(rsa->q != NULL);  assert(rsa->dmp1 != NULL);  assert(rsa->dmq1 != NULL);  assert(rsa->iqmp != NULL);  BIGNUM *r1, *m1, *vrfy;  BIGNUM local_dmp1, local_dmq1, local_c, local_r1;  BIGNUM *dmp1, *dmq1, *c, *pr1;  int ret = 0;  size_t i, num_additional_primes = 0;  if (rsa->additional_primes != NULL) {    num_additional_primes = sk_RSA_additional_prime_num(rsa->additional_primes);  }  BN_CTX_start(ctx);  r1 = BN_CTX_get(ctx);  m1 = BN_CTX_get(ctx);  vrfy = BN_CTX_get(ctx);  if (r1 == NULL ||      m1 == NULL ||      vrfy == NULL) {    goto err;  }  {    BIGNUM local_p, local_q;    BIGNUM *p = NULL, *q = NULL;    /* Make sure BN_mod in Montgomery initialization uses BN_FLG_CONSTTIME. */    BN_init(&local_p);    p = &local_p;    BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);    BN_init(&local_q);    q = &local_q;    BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);    if (!BN_MONT_CTX_set_locked(&rsa->mont_p, &rsa->lock, p, ctx) ||        !BN_MONT_CTX_set_locked(&rsa->mont_q, &rsa->lock, q, ctx)) {      goto err;    }  }  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx)) {    goto err;  }  /* compute I mod q */  c = &local_c;  BN_with_flags(c, I, BN_FLG_CONSTTIME);  if (!BN_mod(r1, c, rsa->q, ctx)) {    goto err;  }  /* compute r1^dmq1 mod q */  dmq1 = &local_dmq1;  BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);  if (!BN_mod_exp_mont_consttime(m1, r1, dmq1, rsa->q, ctx, rsa->mont_q)) {    goto err;  }  /* compute I mod p */  c = &local_c;  BN_with_flags(c, I, BN_FLG_CONSTTIME);  if (!BN_mod(r1, c, rsa->p, ctx)) {    goto err;  }  /* compute r1^dmp1 mod p */  dmp1 = &local_dmp1;  BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);  if (!BN_mod_exp_mont_consttime(r0, r1, dmp1, rsa->p, ctx, rsa->mont_p)) {    goto err;  }  if (!BN_sub(r0, r0, m1)) {    goto err;  }  /* This will help stop the size of r0 increasing, which does   * affect the multiply if it optimised for a power of 2 size */  if (BN_is_negative(r0)) {    if (!BN_add(r0, r0, rsa->p)) {      goto err;    }  }  if (!BN_mul(r1, r0, rsa->iqmp, ctx)) {    goto err;  }  /* Turn BN_FLG_CONSTTIME flag on before division operation */  pr1 = &local_r1;//.........这里部分代码省略.........

int RSA_verify_raw(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,                   const uint8_t *in, size_t in_len, int padding) {  if (rsa->n == NULL || rsa->e == NULL) {    OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);    return 0;  }  const unsigned rsa_size = RSA_size(rsa);  BIGNUM *f, *result;  int r = -1;  if (max_out < rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);    return 0;  }  if (in_len != rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_LEN_NOT_EQUAL_TO_MOD_LEN);    return 0;  }  if (!check_modulus_and_exponent_sizes(rsa)) {    return 0;  }  BN_CTX *ctx = BN_CTX_new();  if (ctx == NULL) {    return 0;  }  int ret = 0;  uint8_t *buf = NULL;  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  if (f == NULL || result == NULL) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (padding == RSA_NO_PADDING) {    buf = out;  } else {    /* Allocate a temporary buffer to hold the padded plaintext. */    buf = OPENSSL_malloc(rsa_size);    if (buf == NULL) {      OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);      goto err;    }  }  if (BN_bin2bn(in, in_len, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx) ||      !BN_mod_exp_mont(result, f, rsa->e, rsa->n, ctx, rsa->mont_n)) {    goto err;  }  if (!BN_bn2bin_padded(buf, rsa_size, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  switch (padding) {    case RSA_PKCS1_PADDING:      r = RSA_padding_check_PKCS1_type_1(out, rsa_size, buf, rsa_size);      break;    case RSA_NO_PADDING:      r = rsa_size;      break;    default:      OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE);      goto err;  }  if (r < 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_PADDING_CHECK_FAILED);  } else {    *out_len = r;    ret = 1;  }err:  BN_CTX_end(ctx);  BN_CTX_free(ctx);  if (buf != out) {    OPENSSL_free(buf);  }  return ret;}

/* signature verification */static int RSA_eay_public_decrypt(int flen, const unsigned char *from,	     unsigned char *to, RSA *rsa, int padding)	{	BIGNUM *f,*ret;	int i,num=0,r= -1;	unsigned char *p;	unsigned char *buf=NULL;	BN_CTX *ctx=NULL;	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);		return -1;		}	if (BN_ucmp(rsa->n, rsa->e) <= 0)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);		return -1;		}	/* for large moduli, enforce exponent limit */	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)		{		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)			{			RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);			return -1;			}		}		if((ctx = BN_CTX_new()) == NULL) goto err;	BN_CTX_start(ctx);	f = BN_CTX_get(ctx);	ret = BN_CTX_get(ctx);	num=BN_num_bytes(rsa->n);	buf = OPENSSL_malloc(num);	if(!f || !ret || !buf)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);		goto err;		}	/* This check was for equality but PGP does evil things	 * and chops off the top '0' bytes */	if (flen > num)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);		goto err;		}	if (BN_bin2bn(from,flen,f) == NULL) goto err;	if (BN_ucmp(f, rsa->n) >= 0)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);		goto err;		}	if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)		if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))			goto err;	if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,		rsa->_method_mod_n)) goto err;	if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))		BN_sub(ret, rsa->n, ret);	p=buf;	i=BN_bn2bin(ret,p);	switch (padding)		{	case RSA_PKCS1_PADDING:		r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);		break;	case RSA_X931_PADDING:		r=RSA_padding_check_X931(to,num,buf,i,num);		break;	case RSA_NO_PADDING:		r=RSA_padding_check_none(to,num,buf,i,num);		break;	default:		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);		goto err;		}	if (r < 0)		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);err:	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	if (buf != NULL)		{		OPENSSL_cleanse(buf,num);//.........这里部分代码省略.........

//.........这里部分代码省略.........	case RSA_NO_PADDING:		i=RSA_padding_add_none(buf,num,from,flen);		break;	case RSA_SSLV23_PADDING:	default:		RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);		goto err;		}	if (i <= 0) goto err;	if (BN_bin2bn(buf,num,f) == NULL) goto err;		if (BN_ucmp(f, rsa->n) >= 0)		{			/* usually the padding functions would catch this */		RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);		goto err;		}	if (!(rsa->flags & RSA_FLAG_NO_BLINDING))		{		blinding = rsa_get_blinding(rsa, &local_blinding, ctx);		if (blinding == NULL)			{			RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);			goto err;			}		}		if (blinding != NULL)		if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))			goto err;	if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||		((rsa->p != NULL) &&		(rsa->q != NULL) &&		(rsa->dmp1 != NULL) &&		(rsa->dmq1 != NULL) &&		(rsa->iqmp != NULL)) )		{ 		if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;		}	else		{		BIGNUM local_d;		BIGNUM *d = NULL;				if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))			{			BN_init(&local_d);			d = &local_d;			BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);			}		else			d= rsa->d;		if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)			if(!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))				goto err;		if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,				rsa->_method_mod_n)) goto err;		}	if (blinding)		if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))			goto err;	if (padding == RSA_X931_PADDING)		{		BN_sub(f, rsa->n, ret);		if (BN_cmp(ret, f))			res = f;		else			res = ret;		}	else		res = ret;	/* put in leading 0 bytes if the number is less than the	 * length of the modulus */	j=BN_num_bytes(res);	i=BN_bn2bin(res,&(to[num-j]));	for (k=0; k<(num-i); k++)		to[k]=0;	r=num;err:	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	if (buf != NULL)		{		OPENSSL_cleanse(buf,num);		OPENSSL_free(buf);		}	return(r);	}

static inteay_dh_generate_key(DH *dh){	int ok = 0;	int generate_new_key = 0;	unsigned l;	BN_CTX *ctx;#if 0	BN_MONT_CTX *mont = NULL;#endif	BIGNUM *pub_key = NULL, *priv_key = NULL;	ctx = BN_CTX_new();	if (ctx == NULL) {		goto err;	}	if (dh->priv_key == NULL) {		priv_key = BN_new();		if (priv_key == NULL) {			goto err;		}		generate_new_key = 1;	} else{		priv_key = dh->priv_key;	}	if (dh->pub_key == NULL) {		pub_key = BN_new();		if (pub_key == NULL) {			goto err;		}	} else{		pub_key = dh->pub_key;	}#if 0	if (dh->flags & DH_FLAG_CACHE_MONT_P) {		mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,			CRYPTO_LOCK_DH, dh->p, ctx);		if (!mont) {			goto err;		}	}#endif	if (generate_new_key) {		l = dh->length ? dh->length : BN_num_bits(dh->p) - 1; /* secret exponent length */		if (!BN_rand(priv_key, l, 0, 0)) {			goto err;		}	}	{		BIGNUM local_prk;		BIGNUM *prk;#if 0		if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {			BN_init(&local_prk);			prk = &local_prk;			BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);		} else#endif		prk = priv_key;		if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx /* , mont */)) {			goto err;		}	}	dh->pub_key = pub_key;	dh->priv_key = priv_key;	ok = 1;err:	/*	 * if (ok != 1)	 *      DHerr(DH_F_GENERATE_KEY,ERR_R_BN_LIB);	 */	if ((pub_key != NULL) && (dh->pub_key == NULL)) {		BN_clear_free(pub_key);	}	if ((priv_key != NULL) && (dh->priv_key == NULL)) {		BN_clear_free(priv_key);	}	BN_CTX_free(ctx);	return (ok);}

static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx){    BIGNUM *r1, *m1, *vrfy;    int ret = 0;    BN_CTX_start(ctx);    r1 = BN_CTX_get(ctx);    m1 = BN_CTX_get(ctx);    vrfy = BN_CTX_get(ctx);    {        BIGNUM *local_p = NULL, *local_q = NULL;        BIGNUM *p = NULL, *q = NULL;        /*         * Make sure BN_mod_inverse in Montgomery initialization uses the         * BN_FLG_CONSTTIME flag (unless RSA_FLAG_NO_CONSTTIME is set)         */        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {            local_p = p = BN_new();            if (p == NULL)                goto err;            BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);            local_q = q = BN_new();            if (q == NULL) {                BN_free(local_p);                goto err;            }            BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);        } else {            p = rsa->p;            q = rsa->q;        }        if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) {            if (!BN_MONT_CTX_set_locked                (&rsa->_method_mod_p, CRYPTO_LOCK_RSA, p, ctx)                || !BN_MONT_CTX_set_locked(&rsa->_method_mod_q,                                           CRYPTO_LOCK_RSA, q, ctx)) {                BN_free(local_p);                BN_free(local_q);                goto err;            }        }        /*         * We MUST free local_p and local_q before any further use of rsa->p and         * rsa->q         */        BN_free(local_p);        BN_free(local_q);    }    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)        if (!BN_MONT_CTX_set_locked            (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))            goto err;    /* compute I mod q */    {        BIGNUM *local_c = NULL;        const BIGNUM *c;        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {            local_c = BN_new();            if (local_c == NULL)                goto err;            BN_with_flags(local_c, I, BN_FLG_CONSTTIME);            c = local_c;        } else {            c = I;        }        if (!BN_mod(r1, c, rsa->q, ctx)) {            BN_free(local_c);            goto err;        }        {            BIGNUM *local_dmq1 = NULL, *dmq1;            /* compute r1^dmq1 mod q */            if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {                dmq1 = local_dmq1 = BN_new();                if (local_dmq1 == NULL) {                    BN_free(local_c);                    goto err;                }                BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);            } else {                dmq1 = rsa->dmq1;            }            if (!rsa->meth->bn_mod_exp(m1, r1, dmq1, rsa->q, ctx,                rsa->_method_mod_q)) {                BN_free(local_c);                BN_free(local_dmq1);                goto err;            }            /* We MUST free local_dmq1 before any further use of rsa->dmq1 */            BN_free(local_dmq1);        }//.........这里部分代码省略.........

int rsa_default_verify_raw(RSA *rsa, size_t *out_len, uint8_t *out,                           size_t max_out, const uint8_t *in, size_t in_len,                           int padding) {  const unsigned rsa_size = RSA_size(rsa);  BIGNUM *f, *result;  int ret = 0;  int r = -1;  uint8_t *buf = NULL;  BN_CTX *ctx = NULL;  if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE);    return 0;  }  if (BN_ucmp(rsa->n, rsa->e) <= 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  if (max_out < rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);    return 0;  }  /* for large moduli, enforce exponent limit */  if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS &&      BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  if (padding == RSA_NO_PADDING) {    buf = out;  } else {    /* Allocate a temporary buffer to hold the padded plaintext. */    buf = OPENSSL_malloc(rsa_size);    if (buf == NULL) {      OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);      goto err;    }  }  if (!f || !result) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (in_len != rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_LEN_NOT_EQUAL_TO_MOD_LEN);    goto err;  }  if (BN_bin2bn(in, in_len, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {    if (BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx) == NULL) {      goto err;    }  }  if (!rsa->meth->bn_mod_exp(result, f, rsa->e, rsa->n, ctx, rsa->mont_n)) {    goto err;  }  if (!BN_bn2bin_padded(buf, rsa_size, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  switch (padding) {    case RSA_PKCS1_PADDING:      r = RSA_padding_check_PKCS1_type_1(out, rsa_size, buf, rsa_size);      break;    case RSA_NO_PADDING:      r = rsa_size;      break;    default:      OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE);      goto err;  }  if (r < 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_PADDING_CHECK_FAILED);  } else {    *out_len = r;//.........这里部分代码省略.........

static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,      DSA *dsa)  {  BN_CTX *ctx;  BIGNUM u1,u2,t1;  BN_MONT_CTX *mont=NULL;  int ret = -1;  if (!dsa->p || !dsa->q || !dsa->g)    {    DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MISSING_PARAMETERS);    return -1;    }  BN_init(&u1);  BN_init(&u2);  BN_init(&t1);  if ((ctx=BN_CTX_new()) == NULL) goto err;  if (BN_is_zero(sig->r) || BN_is_negative(sig->r) ||      BN_ucmp(sig->r, dsa->q) >= 0)    {    ret = 0;    goto err;    }  if (BN_is_zero(sig->s) || BN_is_negative(sig->s) ||      BN_ucmp(sig->s, dsa->q) >= 0)    {    ret = 0;    goto err;    }  /* Calculate W = inv(S) mod Q   * save W in u2 */  if ((BN_mod_inverse(&u2,sig->s,dsa->q,ctx)) == NULL) goto err;  /* save M in u1 */  if (BN_bin2bn(dgst,dgst_len,&u1) == NULL) goto err;  /* u1 = M * w mod q */  if (!BN_mod_mul(&u1,&u1,&u2,dsa->q,ctx)) goto err;  /* u2 = r * w mod q */  if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;  if (dsa->flags & DSA_FLAG_CACHE_MONT_P)    {    mont = BN_MONT_CTX_set_locked(&dsa->method_mont_p,          CRYPTO_LOCK_DSA, dsa->p, ctx);    if (!mont)      goto err;    }  DSA_MOD_EXP(goto err, dsa, &t1, dsa->g, &u1, dsa->pub_key, &u2, dsa->p, ctx, mont);  /* BN_copy(&u1,&t1); */  /* let u1 = u1 mod q */  if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;  /* V is now in u1.  If the signature is correct, it will be   * equal to R. */  ret=(BN_ucmp(&u1, sig->r) == 0);  err:  /* XXX: surely this is wrong - if ret is 0, it just didn't verify;     there is no error in BN. Test should be ret == -1 (Ben) */  if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);  if (ctx != NULL) BN_CTX_free(ctx);  BN_free(&u1);  BN_free(&u2);  BN_free(&t1);  return(ret);  }

static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)  {  BN_CTX *ctx;  BIGNUM k,kq,*K,*kinv=NULL,*r=NULL;  int ret=0;  if (!dsa->p || !dsa->q || !dsa->g)    {    DSAerr(DSA_F_DSA_SIGN_SETUP,DSA_R_MISSING_PARAMETERS);    return 0;    }  BN_init(&k);  BN_init(&kq);  if (ctx_in == NULL)    {    if ((ctx=BN_CTX_new()) == NULL) goto err;    }  else    ctx=ctx_in;  if ((r=BN_new()) == NULL) goto err;  /* Get random k */  do    if (!BN_rand_range(&k, dsa->q)) goto err;  while (BN_is_zero(&k));  if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0)    {    BN_set_flags(&k, BN_FLG_EXP_CONSTTIME);    }  if (dsa->flags & DSA_FLAG_CACHE_MONT_P)    {    if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p,            CRYPTO_LOCK_DSA,            dsa->p, ctx))      goto err;    }  /* Compute r = (g^k mod p) mod q */  if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0)    {    if (!BN_copy(&kq, &k)) goto err;    /* We do not want timing information to leak the length of k,     * so we compute g^k using an equivalent exponent of fixed length.     *     * (This is a kludge that we need because the BN_mod_exp_mont()     * does not let us specify the desired timing behaviour.) */    if (!BN_add(&kq, &kq, dsa->q)) goto err;    if (BN_num_bits(&kq) <= BN_num_bits(dsa->q))      {      if (!BN_add(&kq, &kq, dsa->q)) goto err;      }    K = &kq;    }  else    {    K = &k;    }  DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, K, dsa->p, ctx,      dsa->method_mont_p);  if (!BN_mod(r,r,dsa->q,ctx)) goto err;  /* Compute  part of 's = inv(k) (m + xr) mod q' */  if ((kinv=BN_mod_inverse(NULL,&k,dsa->q,ctx)) == NULL) goto err;  if (*kinvp != NULL) BN_clear_free(*kinvp);  *kinvp=kinv;  kinv=NULL;  if (*rp != NULL) BN_clear_free(*rp);  *rp=r;  ret=1;err:  if (!ret)    {    DSAerr(DSA_F_DSA_SIGN_SETUP,ERR_R_BN_LIB);    if (kinv != NULL) BN_clear_free(kinv);    if (r != NULL) BN_clear_free(r);    }  if (ctx_in == NULL) BN_CTX_free(ctx);  if (kinv != NULL) BN_clear_free(kinv);  BN_clear_free(&k);  BN_clear_free(&kq);  return(ret);  }

static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,		  DSA *dsa)	{	BN_CTX *ctx;	BIGNUM u1,u2,t1;	BN_MONT_CTX *mont=NULL;	int ret = -1;	if (!dsa->p || !dsa->q || !dsa->g)		{		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MISSING_PARAMETERS);		return -1;		}	if (BN_num_bits(dsa->q) != 160)		{		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE);		return -1;		}	if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS)		{		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE);		return -1;		}	BN_init(&u1);	BN_init(&u2);	BN_init(&t1);	if ((ctx=BN_CTX_new()) == NULL) goto err;	if (BN_is_zero(sig->r) || sig->r->neg || BN_ucmp(sig->r, dsa->q) >= 0)		{		ret = 0;		goto err;		}	if (BN_is_zero(sig->s) || sig->s->neg || BN_ucmp(sig->s, dsa->q) >= 0)		{		ret = 0;		goto err;		}	/* Calculate W = inv(S) mod Q	 * save W in u2 */	if ((BN_mod_inverse(&u2,sig->s,dsa->q,ctx)) == NULL) goto err;	/* save M in u1 */	if (BN_bin2bn(dgst,dgst_len,&u1) == NULL) goto err;	/* u1 = M * w mod q */	if (!BN_mod_mul(&u1,&u1,&u2,dsa->q,ctx)) goto err;	/* u2 = r * w mod q */	if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;	if (dsa->flags & DSA_FLAG_CACHE_MONT_P)		{		mont = BN_MONT_CTX_set_locked(					(BN_MONT_CTX **)&dsa->method_mont_p,					CRYPTO_LOCK_DSA, dsa->p, ctx);		if (!mont)			goto err;		}#if 0	{	BIGNUM t2;	BN_init(&t2);	/* v = ( g^u1 * y^u2 mod p ) mod q */	/* let t1 = g ^ u1 mod p */	if (!BN_mod_exp_mont(&t1,dsa->g,&u1,dsa->p,ctx,mont)) goto err;	/* let t2 = y ^ u2 mod p */	if (!BN_mod_exp_mont(&t2,dsa->pub_key,&u2,dsa->p,ctx,mont)) goto err;	/* let u1 = t1 * t2 mod p */	if (!BN_mod_mul(&u1,&t1,&t2,dsa->p,ctx)) goto err_bn;	BN_free(&t2);	}	/* let u1 = u1 mod q */	if (!BN_mod(&u1,&u1,dsa->q,ctx)) goto err;#else	{	if (!dsa->meth->dsa_mod_exp(dsa, &t1,dsa->g,&u1,dsa->pub_key,&u2,						dsa->p,ctx,mont)) goto err;	/* BN_copy(&u1,&t1); */	/* let u1 = u1 mod q */	if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;	}#endif	/* V is now in u1.  If the signature is correct, it will be	 * equal to R. */	ret=(BN_ucmp(&u1, sig->r) == 0);	err:	if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);	if (ctx != NULL) BN_CTX_free(ctx);	BN_free(&u1);	BN_free(&u2);	BN_free(&t1);//.........这里部分代码省略.........

static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {  BIGNUM *r1, *m1, *vrfy;  BIGNUM local_dmp1, local_dmq1, local_c, local_r1;  BIGNUM *dmp1, *dmq1, *c, *pr1;  int ret = 0;  size_t i, num_additional_primes = 0;  if (rsa->additional_primes != NULL) {    num_additional_primes = sk_RSA_additional_prime_num(rsa->additional_primes);  }  BN_CTX_start(ctx);  r1 = BN_CTX_get(ctx);  m1 = BN_CTX_get(ctx);  vrfy = BN_CTX_get(ctx);  {    BIGNUM local_p, local_q;    BIGNUM *p = NULL, *q = NULL;    /* Make sure BN_mod_inverse in Montgomery intialization uses the     * BN_FLG_CONSTTIME flag (unless RSA_FLAG_NO_CONSTTIME is set) */    BN_init(&local_p);    p = &local_p;    BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);    BN_init(&local_q);    q = &local_q;    BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);    if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) {      if (BN_MONT_CTX_set_locked(&rsa->_method_mod_p, &rsa->lock, p, ctx) ==          NULL) {        goto err;      }      if (BN_MONT_CTX_set_locked(&rsa->_method_mod_q, &rsa->lock, q, ctx) ==          NULL) {        goto err;      }    }  }  if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {    if (BN_MONT_CTX_set_locked(&rsa->_method_mod_n, &rsa->lock, rsa->n, ctx) ==        NULL) {      goto err;    }  }  /* compute I mod q */  c = &local_c;  BN_with_flags(c, I, BN_FLG_CONSTTIME);  if (!BN_mod(r1, c, rsa->q, ctx)) {    goto err;  }  /* compute r1^dmq1 mod q */  dmq1 = &local_dmq1;  BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);  if (!rsa->meth->bn_mod_exp(m1, r1, dmq1, rsa->q, ctx, rsa->_method_mod_q)) {    goto err;  }  /* compute I mod p */  c = &local_c;  BN_with_flags(c, I, BN_FLG_CONSTTIME);  if (!BN_mod(r1, c, rsa->p, ctx)) {    goto err;  }  /* compute r1^dmp1 mod p */  dmp1 = &local_dmp1;  BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);  if (!rsa->meth->bn_mod_exp(r0, r1, dmp1, rsa->p, ctx, rsa->_method_mod_p)) {    goto err;  }  if (!BN_sub(r0, r0, m1)) {    goto err;  }  /* This will help stop the size of r0 increasing, which does   * affect the multiply if it optimised for a power of 2 size */  if (BN_is_negative(r0)) {    if (!BN_add(r0, r0, rsa->p)) {      goto err;    }  }  if (!BN_mul(r1, r0, rsa->iqmp, ctx)) {    goto err;  }  /* Turn BN_FLG_CONSTTIME flag on before division operation */  pr1 = &local_r1;  BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);  if (!BN_mod(r0, pr1, rsa->p, ctx)) {    goto err;  }//.........这里部分代码省略.........

static int my_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,                   const uint8_t *in, size_t in_len, int padding) {  const unsigned rsa_size = RSA_size(rsa);  BIGNUM *f, *result;  uint8_t *buf = NULL;  BN_CTX *ctx = NULL;  int i, ret = 0;  printf("my encrypt/n");  if (rsa_size > OPENSSL_RSA_MAX_MODULUS_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE);    return 0;  }  if (max_out < rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);    return 0;  }  if (BN_ucmp(rsa->n, rsa->e) <= 0) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  /* for large moduli, enforce exponent limit */  if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS &&      BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) {    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);    return 0;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  buf = OPENSSL_malloc(rsa_size);  if (!f || !result || !buf) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  switch (padding) {    case RSA_PKCS1_PADDING:      i = RSA_padding_add_PKCS1_type_2(buf, rsa_size, in, in_len);      break;    case RSA_PKCS1_OAEP_PADDING:      /* Use the default parameters: SHA-1 for both hashes and no label. */      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len,                                          NULL, 0, NULL, NULL);      break;    case RSA_NO_PADDING:      i = RSA_padding_add_none(buf, rsa_size, in, in_len);      break;    default:      OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE);      goto err;  }  if (i <= 0) {    goto err;  }  if (BN_bin2bn(buf, rsa_size, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    /* usually the padding functions would catch this */    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {    if (BN_MONT_CTX_set_locked(&rsa->_method_mod_n, &rsa->lock, rsa->n, ctx) ==        NULL) {      goto err;    }  }  printf("before my bn_mod_exp/n");  if (!rsa->meth->bn_mod_exp(result, f, rsa->e, rsa->n, ctx,                             rsa->_method_mod_n)) {    goto err;  }  printf("after my bn_mod_exp/n");  /* put in leading 0 bytes if the number is less than the length of the   * modulus */  if (!BN_bn2bin_padded(out, rsa_size, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  *out_len = rsa_size;  ret = 1;//.........这里部分代码省略.........

/* signing */static int rsa_ossl_private_encrypt(int flen, const unsigned char *from,                                   unsigned char *to, RSA *rsa, int padding){    BIGNUM *f, *ret, *res;    int i, j, k, num = 0, r = -1;    unsigned char *buf = NULL;    BN_CTX *ctx = NULL;    int local_blinding = 0;    /*     * Used only if the blinding structure is shared. A non-NULL unblind     * instructs rsa_blinding_convert() and rsa_blinding_invert() to store     * the unblinding factor outside the blinding structure.     */    BIGNUM *unblind = NULL;    BN_BLINDING *blinding = NULL;    if ((ctx = BN_CTX_new()) == NULL)        goto err;    BN_CTX_start(ctx);    f = BN_CTX_get(ctx);    ret = BN_CTX_get(ctx);    num = BN_num_bytes(rsa->n);    buf = OPENSSL_malloc(num);    if (ret == NULL || buf == NULL) {        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);        goto err;    }    switch (padding) {    case RSA_PKCS1_PADDING:        i = RSA_padding_add_PKCS1_type_1(buf, num, from, flen);        break;    case RSA_X931_PADDING:        i = RSA_padding_add_X931(buf, num, from, flen);        break;    case RSA_NO_PADDING:        i = RSA_padding_add_none(buf, num, from, flen);        break;    case RSA_SSLV23_PADDING:    default:        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);        goto err;    }    if (i <= 0)        goto err;    if (BN_bin2bn(buf, num, f) == NULL)        goto err;    if (BN_ucmp(f, rsa->n) >= 0) {        /* usually the padding functions would catch this */        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT,               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);        goto err;    }    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);        if (blinding == NULL) {            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);            goto err;        }    }    if (blinding != NULL) {        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);            goto err;        }        if (!rsa_blinding_convert(blinding, f, unblind, ctx))            goto err;    }    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||        (rsa->version == RSA_ASN1_VERSION_MULTI) ||        ((rsa->p != NULL) &&         (rsa->q != NULL) &&         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))            goto err;    } else {        BIGNUM *d = BN_new();        if (d == NULL) {            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);            goto err;        }        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)            if (!BN_MONT_CTX_set_locked                (&rsa->_method_mod_n, rsa->lock, rsa->n, ctx)) {                BN_free(d);                goto err;            }        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,                                   rsa->_method_mod_n)) {            BN_free(d);            goto err;//.........这里部分代码省略.........

static int RSA_eay_public_encrypt(int flen, const unsigned char *from,	     unsigned char *to, RSA *rsa, int padding)	{	BIGNUM *f,*ret;	int i,j,k,num=0,r= -1;	unsigned char *buf=NULL;	BN_CTX *ctx=NULL;	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);		return -1;		}	if (BN_ucmp(rsa->n, rsa->e) <= 0)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);		return -1;		}	/* for large moduli, enforce exponent limit */	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)		{		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)			{			RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);			return -1;			}		}		if ((ctx=BN_CTX_new()) == NULL) goto err;	BN_CTX_start(ctx);	f = BN_CTX_get(ctx);	ret = BN_CTX_get(ctx);	num=BN_num_bytes(rsa->n);	buf = OPENSSL_malloc(num);	if (!f || !ret || !buf)		{		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);		goto err;		}	switch (padding)		{	case RSA_PKCS1_PADDING:		i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);		break;#ifndef OPENSSL_NO_SHA	case RSA_PKCS1_OAEP_PADDING:	        i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);		break;#endif	case RSA_SSLV23_PADDING:		i=RSA_padding_add_SSLv23(buf,num,from,flen);		break;	case RSA_NO_PADDING:		i=RSA_padding_add_none(buf,num,from,flen);		break;	default:		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);		goto err;		}	if (i <= 0) goto err;	if (BN_bin2bn(buf,num,f) == NULL) goto err;		if (BN_ucmp(f, rsa->n) >= 0)		{		/* usually the padding functions would catch this */		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);		goto err;		}	if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)		if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))			goto err;	if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,		rsa->_method_mod_n)) goto err;	/* put in leading 0 bytes if the number is less than the	 * length of the modulus */	j=BN_num_bytes(ret);	i=BN_bn2bin(ret,&(to[num-j]));	for (k=0; k<(num-i); k++)		to[k]=0;	r=num;err:	if (ctx != NULL)		{		BN_CTX_end(ctx);		BN_CTX_free(ctx);		}	if (buf != NULL) 		{		OPENSSL_cleanse(buf,num);		OPENSSL_free(buf);		}	return(r);//.........这里部分代码省略.........

static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,                                   unsigned char *to, RSA *rsa, int padding){    BIGNUM *f, *ret;    int j, num = 0, r = -1;    unsigned char *p;    unsigned char *buf = NULL;    BN_CTX *ctx = NULL;    int local_blinding = 0;    /*     * Used only if the blinding structure is shared. A non-NULL unblind     * instructs rsa_blinding_convert() and rsa_blinding_invert() to store     * the unblinding factor outside the blinding structure.     */    BIGNUM *unblind = NULL;    BN_BLINDING *blinding = NULL;    if ((ctx = BN_CTX_new()) == NULL)        goto err;    BN_CTX_start(ctx);    f = BN_CTX_get(ctx);    ret = BN_CTX_get(ctx);    num = BN_num_bytes(rsa->n);    buf = OPENSSL_malloc(num);    if (ret == NULL || buf == NULL) {        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);        goto err;    }    /*     * This check was for equality but PGP does evil things and chops off the     * top '0' bytes     */    if (flen > num) {        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,               RSA_R_DATA_GREATER_THAN_MOD_LEN);        goto err;    }    /* make data into a big number */    if (BN_bin2bn(from, (int)flen, f) == NULL)        goto err;    if (BN_ucmp(f, rsa->n) >= 0) {        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);        goto err;    }    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);        if (blinding == NULL) {            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);            goto err;        }    }    if (blinding != NULL) {        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);            goto err;        }        if (!rsa_blinding_convert(blinding, f, unblind, ctx))            goto err;    }    /* do the decrypt */    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||        (rsa->version == RSA_ASN1_VERSION_MULTI) ||        ((rsa->p != NULL) &&         (rsa->q != NULL) &&         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))            goto err;    } else {        BIGNUM *d = BN_new();        if (d == NULL) {            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);            goto err;        }        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)            if (!BN_MONT_CTX_set_locked                (&rsa->_method_mod_n, rsa->lock, rsa->n, ctx)) {                BN_free(d);                goto err;            }        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,                                   rsa->_method_mod_n)) {            BN_free(d);            goto err;        }        /* We MUST free d before any further use of rsa->d */        BN_free(d);    }    if (blinding)        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))            goto err;//.........这里部分代码省略.........

static int RSA_eay_private_decrypt(int flen, const unsigned char *from,	     unsigned char *to, RSA *rsa, int padding)	{	BIGNUM *f, *ret, *br;	int j,num=0,r= -1;	unsigned char *p;	unsigned char *buf=NULL;	BN_CTX *ctx=NULL;	int local_blinding = 0;	BN_BLINDING *blinding = NULL;	if((ctx = BN_CTX_new()) == NULL) goto err;	BN_CTX_start(ctx);	f   = BN_CTX_get(ctx);	br  = BN_CTX_get(ctx);	ret = BN_CTX_get(ctx);	num = BN_num_bytes(rsa->n);	buf = OPENSSL_malloc(num);	if(!f || !ret || !buf)		{		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);		goto err;		}	/* This check was for equality but PGP does evil things	 * and chops off the top '0' bytes */	if (flen > num)		{		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);		goto err;		}	/* make data into a big number */	if (BN_bin2bn(from,(int)flen,f) == NULL) goto err;	if (BN_ucmp(f, rsa->n) >= 0)		{		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);		goto err;		}	if (!(rsa->flags & RSA_FLAG_NO_BLINDING))		{		blinding = rsa_get_blinding(rsa, &local_blinding, ctx);		if (blinding == NULL)			{			RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);			goto err;			}		}		if (blinding != NULL)		if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))			goto err;	/* do the decrypt */	if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||		((rsa->p != NULL) &&		(rsa->q != NULL) &&		(rsa->dmp1 != NULL) &&		(rsa->dmq1 != NULL) &&		(rsa->iqmp != NULL)) )		{		if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;		}	else		{		BIGNUM local_d;		BIGNUM *d = NULL;				if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))			{			d = &local_d;			BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);			}		else			d = rsa->d;		if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)			if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))				goto err;		if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,				rsa->_method_mod_n))		  goto err;		}	if (blinding)		if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))			goto err;	p=buf;	j=BN_bn2bin(ret,p); /* j is only used with no-padding mode */	switch (padding)		{	case RSA_PKCS1_PADDING:		r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num);		break;#ifndef OPENSSL_NO_SHA        case RSA_PKCS1_OAEP_PADDING://.........这里部分代码省略.........

static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx){    BIGNUM *r1, *m1, *vrfy, *r2, *m[RSA_MAX_PRIME_NUM - 2];    int ret = 0, i, ex_primes = 0;    RSA_PRIME_INFO *pinfo;    BN_CTX_start(ctx);    r1 = BN_CTX_get(ctx);    r2 = BN_CTX_get(ctx);    m1 = BN_CTX_get(ctx);    vrfy = BN_CTX_get(ctx);    if (vrfy == NULL)        goto err;    if (rsa->version == RSA_ASN1_VERSION_MULTI        && ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0             || ex_primes > RSA_MAX_PRIME_NUM - 2))        goto err;    {        BIGNUM *p = BN_new(), *q = BN_new();        /*         * Make sure BN_mod_inverse in Montgomery initialization uses the         * BN_FLG_CONSTTIME flag         */        if (p == NULL || q == NULL) {            BN_free(p);            BN_free(q);            goto err;        }        BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);        BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);        if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) {            if (!BN_MONT_CTX_set_locked                (&rsa->_method_mod_p, rsa->lock, p, ctx)                || !BN_MONT_CTX_set_locked(&rsa->_method_mod_q,                                           rsa->lock, q, ctx)) {                BN_free(p);                BN_free(q);                goto err;            }            if (ex_primes > 0) {                /* cache BN_MONT_CTX for other primes */                BIGNUM *r = BN_new();                if (r == NULL) {                    BN_free(p);                    BN_free(q);                    goto err;                }                for (i = 0; i < ex_primes; i++) {                    pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);                    BN_with_flags(r, pinfo->r, BN_FLG_CONSTTIME);                    if (!BN_MONT_CTX_set_locked(&pinfo->m, rsa->lock, r, ctx)) {                        BN_free(p);                        BN_free(q);                        BN_free(r);                        goto err;                    }                }                BN_free(r);            }        }        /*         * We MUST free p and q before any further use of rsa->p and rsa->q         */        BN_free(p);        BN_free(q);    }    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)        if (!BN_MONT_CTX_set_locked            (&rsa->_method_mod_n, rsa->lock, rsa->n, ctx))            goto err;    /* compute I mod q */    {        BIGNUM *c = BN_new();        if (c == NULL)            goto err;        BN_with_flags(c, I, BN_FLG_CONSTTIME);        if (!BN_mod(r1, c, rsa->q, ctx)) {            BN_free(c);            goto err;        }        {            BIGNUM *dmq1 = BN_new();            if (dmq1 == NULL) {                BN_free(c);                goto err;            }            BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);            /* compute r1^dmq1 mod q *///.........这里部分代码省略.........

static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)	{	BIGNUM *r1,*m1,*vrfy;	BIGNUM local_dmp1,local_dmq1,local_c,local_r1;	BIGNUM *dmp1,*dmq1,*c,*pr1;	int ret=0;	BN_CTX_start(ctx);	r1 = BN_CTX_get(ctx);	m1 = BN_CTX_get(ctx);	vrfy = BN_CTX_get(ctx);	{		BIGNUM local_p, local_q;		BIGNUM *p = NULL, *q = NULL;		/* Make sure BN_mod_inverse in Montgomery intialization uses the		 * BN_FLG_CONSTTIME flag (unless RSA_FLAG_NO_CONSTTIME is set)		 */		if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))			{			BN_init(&local_p);			p = &local_p;			BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);			BN_init(&local_q);			q = &local_q;			BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);			}		else			{			p = rsa->p;			q = rsa->q;			}		if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)			{			if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_p, CRYPTO_LOCK_RSA, p, ctx))				goto err;			if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_q, CRYPTO_LOCK_RSA, q, ctx))				goto err;			}	}	if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)		if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))			goto err;	/* compute I mod q */	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))		{		c = &local_c;		BN_with_flags(c, I, BN_FLG_CONSTTIME);		if (!BN_mod(r1,c,rsa->q,ctx)) goto err;		}	else		{		if (!BN_mod(r1,I,rsa->q,ctx)) goto err;		}	/* compute r1^dmq1 mod q */	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))		{		dmq1 = &local_dmq1;		BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);		}	else		dmq1 = rsa->dmq1;	if (!rsa->meth->bn_mod_exp(m1,r1,dmq1,rsa->q,ctx,		rsa->_method_mod_q)) goto err;	/* compute I mod p */	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))		{		c = &local_c;		BN_with_flags(c, I, BN_FLG_CONSTTIME);		if (!BN_mod(r1,c,rsa->p,ctx)) goto err;		}	else		{		if (!BN_mod(r1,I,rsa->p,ctx)) goto err;		}	/* compute r1^dmp1 mod p */	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))		{		dmp1 = &local_dmp1;		BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);		}	else		dmp1 = rsa->dmp1;	if (!rsa->meth->bn_mod_exp(r0,r1,dmp1,rsa->p,ctx,		rsa->_method_mod_p)) goto err;	if (!BN_sub(r0,r0,m1)) goto err;	/* This will help stop the size of r0 increasing, which does	 * affect the multiply if it optimised for a power of 2 size */	if (BN_is_negative(r0))		if (!BN_add(r0,r0,rsa->p)) goto err;//.........这里部分代码省略.........

int DH_generate_key(DH *dh) {  int ok = 0;  int generate_new_key = 0;  BN_CTX *ctx = NULL;  BIGNUM *pub_key = NULL, *priv_key = NULL;  if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {    OPENSSL_PUT_ERROR(DH, DH_R_MODULUS_TOO_LARGE);    goto err;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  if (dh->priv_key == NULL) {    priv_key = BN_new();    if (priv_key == NULL) {      goto err;    }    generate_new_key = 1;  } else {    priv_key = dh->priv_key;  }  if (dh->pub_key == NULL) {    pub_key = BN_new();    if (pub_key == NULL) {      goto err;    }  } else {    pub_key = dh->pub_key;  }  if (!BN_MONT_CTX_set_locked(&dh->method_mont_p, &dh->method_mont_p_lock,                              dh->p, ctx)) {    goto err;  }  if (generate_new_key) {    if (dh->q) {      if (!BN_rand_range_ex(priv_key, 2, dh->q)) {        goto err;      }    } else {      // secret exponent length      unsigned priv_bits = dh->priv_length;      if (priv_bits == 0) {        const unsigned p_bits = BN_num_bits(dh->p);        if (p_bits == 0) {          goto err;        }        priv_bits = p_bits - 1;      }      if (!BN_rand(priv_key, priv_bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY)) {        goto err;      }    }  }  if (!BN_mod_exp_mont_consttime(pub_key, dh->g, priv_key, dh->p, ctx,                                 dh->method_mont_p)) {    goto err;  }  dh->pub_key = pub_key;  dh->priv_key = priv_key;  ok = 1;err:  if (ok != 1) {    OPENSSL_PUT_ERROR(DH, ERR_R_BN_LIB);  }  if (dh->pub_key == NULL) {    BN_free(pub_key);  }  if (dh->priv_key == NULL) {    BN_free(priv_key);  }  BN_CTX_free(ctx);  return ok;}

int rsa_default_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,                        const uint8_t *in, size_t in_len, int padding) {  const unsigned rsa_size = RSA_size(rsa);  BIGNUM *f, *result;  uint8_t *buf = NULL;  BN_CTX *ctx = NULL;  int i, ret = 0;  if (max_out < rsa_size) {    OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);    return 0;  }  if (!check_modulus_and_exponent_sizes(rsa)) {    return 0;  }  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  buf = OPENSSL_malloc(rsa_size);  if (!f || !result || !buf) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  switch (padding) {    case RSA_PKCS1_PADDING:      i = RSA_padding_add_PKCS1_type_2(buf, rsa_size, in, in_len);      break;    case RSA_PKCS1_OAEP_PADDING:      /* Use the default parameters: SHA-1 for both hashes and no label. */      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len,                                          NULL, 0, NULL, NULL);      break;    case RSA_NO_PADDING:      i = RSA_padding_add_none(buf, rsa_size, in, in_len);      break;    default:      OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE);      goto err;  }  if (i <= 0) {    goto err;  }  if (BN_bin2bn(buf, rsa_size, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    /* usually the padding functions would catch this */    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx) ||      !BN_mod_exp_mont(result, f, rsa->e, rsa->n, ctx, rsa->mont_n)) {    goto err;  }  /* put in leading 0 bytes if the number is less than the length of the   * modulus */  if (!BN_bn2bin_padded(out, rsa_size, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  *out_len = rsa_size;  ret = 1;err:  if (ctx != NULL) {    BN_CTX_end(ctx);    BN_CTX_free(ctx);  }  if (buf != NULL) {    OPENSSL_cleanse(buf, rsa_size);    OPENSSL_free(buf);  }  return ret;}

static int generate_key(DH *dh)	{	int ok=0;	int generate_new_key=0;	unsigned l;	BN_CTX *ctx;	BN_MONT_CTX *mont=NULL;	BIGNUM *pub_key=NULL,*priv_key=NULL;	if (FIPS_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))		{		DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);		return 0;		}	ctx = BN_CTX_new();	if (ctx == NULL) goto err;	if (dh->priv_key == NULL)		{		priv_key=BN_new();		if (priv_key == NULL) goto err;		generate_new_key=1;		}	else		priv_key=dh->priv_key;	if (dh->pub_key == NULL)		{		pub_key=BN_new();		if (pub_key == NULL) goto err;		}	else		pub_key=dh->pub_key;	if (dh->flags & DH_FLAG_CACHE_MONT_P)		{		mont = BN_MONT_CTX_set_locked(				(BN_MONT_CTX **)&dh->method_mont_p,				CRYPTO_LOCK_DH, dh->p, ctx);		if (!mont)			goto err;		}	if (generate_new_key)		{		l = dh->length ? dh->length : BN_num_bits(dh->p)-1; /* secret exponent length */		if (!BN_rand(priv_key, l, 0, 0)) goto err;		}	{		BIGNUM local_prk;		BIGNUM *prk;		if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)			{			BN_init(&local_prk);			prk = &local_prk;			BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);			}		else			prk = priv_key;		if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont))			goto err;	}			dh->pub_key=pub_key;	dh->priv_key=priv_key;	ok=1;err:	if (ok != 1)		DHerr(DH_F_GENERATE_KEY,ERR_R_BN_LIB);	if ((pub_key != NULL)  && (dh->pub_key == NULL))  BN_free(pub_key);	if ((priv_key != NULL) && (dh->priv_key == NULL)) BN_free(priv_key);	BN_CTX_free(ctx);	return(ok);	}

int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,                                  size_t len) {  BIGNUM *f, *result;  BN_CTX *ctx = NULL;  unsigned blinding_index = 0;  BN_BLINDING *blinding = NULL;  int ret = 0;  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  if (f == NULL || result == NULL) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (BN_bin2bn(in, len, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    /* Usually the padding functions would catch this. */    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  /* We cannot do blinding or verification without |e|, and continuing without   * those countermeasures is dangerous. However, the Java/Android RSA API   * requires support for keys where only |d| and |n| (and not |e|) are known.   * The callers that require that bad behavior set |RSA_FLAG_NO_BLINDING|. */  int disable_security = (rsa->flags & RSA_FLAG_NO_BLINDING) && rsa->e == NULL;  if (!disable_security) {    /* Keys without public exponents must have blinding explicitly disabled to     * be used. */    if (rsa->e == NULL) {      OPENSSL_PUT_ERROR(RSA, RSA_R_NO_PUBLIC_EXPONENT);      goto err;    }    blinding = rsa_blinding_get(rsa, &blinding_index, ctx);    if (blinding == NULL) {      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);      goto err;    }    if (!BN_BLINDING_convert(f, blinding, rsa->e, rsa->mont_n, ctx)) {      goto err;    }  }  if (rsa->p != NULL && rsa->q != NULL && rsa->e != NULL && rsa->dmp1 != NULL &&      rsa->dmq1 != NULL && rsa->iqmp != NULL) {    if (!mod_exp(result, f, rsa, ctx)) {      goto err;    }  } else {    BIGNUM local_d;    BIGNUM *d = NULL;    BN_init(&local_d);    d = &local_d;    BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);    if (!BN_mod_exp_mont_consttime(result, f, d, rsa->n, ctx, rsa->mont_n)) {      goto err;    }  }  /* Verify the result to protect against fault attacks as described in the   * 1997 paper "On the Importance of Checking Cryptographic Protocols for   * Faults" by Dan Boneh, Richard A. DeMillo, and Richard J. Lipton. Some   * implementations do this only when the CRT is used, but we do it in all   * cases. Section 6 of the aforementioned paper describes an attack that   * works when the CRT isn't used. That attack is much less likely to succeed   * than the CRT attack, but there have likely been improvements since 1997.   *   * This check is cheap assuming |e| is small; it almost always is. */  if (!disable_security) {    BIGNUM *vrfy = BN_CTX_get(ctx);    if (vrfy == NULL ||        !BN_mod_exp_mont(vrfy, result, rsa->e, rsa->n, ctx, rsa->mont_n) ||        !BN_equal_consttime(vrfy, f)) {      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);      goto err;    }    if (!BN_BLINDING_invert(result, blinding, rsa->mont_n, ctx)) {      goto err;    }  }//.........这里部分代码省略.........

int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,                                  size_t len) {  BIGNUM *f, *result;  BN_CTX *ctx = NULL;  unsigned blinding_index = 0;  BN_BLINDING *blinding = NULL;  int ret = 0;  ctx = BN_CTX_new();  if (ctx == NULL) {    goto err;  }  BN_CTX_start(ctx);  f = BN_CTX_get(ctx);  result = BN_CTX_get(ctx);  if (f == NULL || result == NULL) {    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);    goto err;  }  if (BN_bin2bn(in, len, f) == NULL) {    goto err;  }  if (BN_ucmp(f, rsa->n) >= 0) {    /* Usually the padding functions would catch this. */    OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);    goto err;  }  if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {    blinding = rsa_blinding_get(rsa, &blinding_index, ctx);    if (blinding == NULL) {      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);      goto err;    }    if (!BN_BLINDING_convert_ex(f, NULL, blinding, ctx)) {      goto err;    }  }  if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||      ((rsa->p != NULL) && (rsa->q != NULL) && (rsa->dmp1 != NULL) &&       (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {    if (!rsa->meth->mod_exp(result, f, rsa, ctx)) {      goto err;    }  } else {    BIGNUM local_d;    BIGNUM *d = NULL;    BN_init(&local_d);    d = &local_d;    BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC) {      if (BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx) ==          NULL) {        goto err;      }    }    if (!rsa->meth->bn_mod_exp(result, f, d, rsa->n, ctx, rsa->mont_n)) {      goto err;    }  }  if (blinding) {    if (!BN_BLINDING_invert_ex(result, NULL, blinding, ctx)) {      goto err;    }  }  if (!BN_bn2bin_padded(out, len, result)) {    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);    goto err;  }  ret = 1;err:  if (ctx != NULL) {    BN_CTX_end(ctx);    BN_CTX_free(ctx);  }  if (blinding != NULL) {    rsa_blinding_release(rsa, blinding, blinding_index);  }  return ret;}

static int generate_key(DH *dh){    int ok = 0;    int generate_new_key = 0;    unsigned l;    BN_CTX *ctx;    BN_MONT_CTX *mont = NULL;    BIGNUM *pub_key = NULL, *priv_key = NULL;    ctx = BN_CTX_new();    if (ctx == NULL)        goto err;    if (dh->priv_key == NULL) {        priv_key = BN_new();        if (priv_key == NULL)            goto err;        generate_new_key = 1;    } else        priv_key = dh->priv_key;    if (dh->pub_key == NULL) {        pub_key = BN_new();        if (pub_key == NULL)            goto err;    } else        pub_key = dh->pub_key;    if (dh->flags & DH_FLAG_CACHE_MONT_P) {        mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,                                      CRYPTO_LOCK_DH, dh->p, ctx);        if (!mont)            goto err;    }    if (generate_new_key) {        if (dh->q) {            do {                if (!BN_rand_range(priv_key, dh->q))                    goto err;            }            while (BN_is_zero(priv_key) || BN_is_one(priv_key));        } else {            /* secret exponent length */            l = dh->length ? dh->length : BN_num_bits(dh->p) - 1;            if (!BN_rand(priv_key, l, 0, 0))                goto err;        }    }    {        BIGNUM local_prk;        BIGNUM *prk;        if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {            BN_init(&local_prk);            prk = &local_prk;            BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);        } else            prk = priv_key;        if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont))            goto err;    }    dh->pub_key = pub_key;    dh->priv_key = priv_key;    ok = 1; err:    if (ok != 1)        DHerr(DH_F_GENERATE_KEY, ERR_R_BN_LIB);    if ((pub_key != NULL) && (dh->pub_key == NULL))        BN_free(pub_key);    if ((priv_key != NULL) && (dh->priv_key == NULL))        BN_free(priv_key);    BN_CTX_free(ctx);    return (ok);}

static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx){    BIGNUM *r1, *m1, *vrfy, *r2, *m[RSA_MAX_PRIME_NUM - 2];    int ret = 0, i, ex_primes = 0, smooth = 0;    RSA_PRIME_INFO *pinfo;    BN_CTX_start(ctx);    r1 = BN_CTX_get(ctx);    r2 = BN_CTX_get(ctx);    m1 = BN_CTX_get(ctx);    vrfy = BN_CTX_get(ctx);    if (vrfy == NULL)        goto err;    if (rsa->version == RSA_ASN1_VERSION_MULTI        && ((ex_primes = sk_RSA_PRIME_INFO_num(rsa->prime_infos)) <= 0             || ex_primes > RSA_MAX_PRIME_NUM - 2))        goto err;    if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) {        BIGNUM *factor = BN_new();        if (factor == NULL)            goto err;        /*         * Make sure BN_mod_inverse in Montgomery initialization uses the         * BN_FLG_CONSTTIME flag         */        if (!(BN_with_flags(factor, rsa->p, BN_FLG_CONSTTIME),              BN_MONT_CTX_set_locked(&rsa->_method_mod_p, rsa->lock,                                     factor, ctx))            || !(BN_with_flags(factor, rsa->q, BN_FLG_CONSTTIME),                 BN_MONT_CTX_set_locked(&rsa->_method_mod_q, rsa->lock,                                        factor, ctx))) {            BN_free(factor);            goto err;        }        for (i = 0; i < ex_primes; i++) {            pinfo = sk_RSA_PRIME_INFO_value(rsa->prime_infos, i);            BN_with_flags(factor, pinfo->r, BN_FLG_CONSTTIME);            if (!BN_MONT_CTX_set_locked(&pinfo->m, rsa->lock, factor, ctx)) {                BN_free(factor);                goto err;            }        }        /*         * We MUST free |factor| before any further use of the prime factors         */        BN_free(factor);        smooth = (ex_primes == 0)                 && (rsa->meth->bn_mod_exp == BN_mod_exp_mont)                 && (BN_num_bits(rsa->q) == BN_num_bits(rsa->p));    }    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,                                    rsa->n, ctx))            goto err;    if (smooth) {        /*         * Conversion from Montgomery domain, a.k.a. Montgomery reduction,         * accepts values in [0-m*2^w) range. w is m's bit width rounded up         * to limb width. So that at the very least if |I| is fully reduced,         * i.e. less than p*q, we can count on from-to round to perform         * below modulo operations on |I|. Unlike BN_mod it's constant time.         */        if (/* m1 = I moq q */            !bn_from_mont_fixed_top(m1, I, rsa->_method_mod_q, ctx)            || !bn_to_mont_fixed_top(m1, m1, rsa->_method_mod_q, ctx)            /* m1 = m1^dmq1 mod q */            || !BN_mod_exp_mont_consttime(m1, m1, rsa->dmq1, rsa->q, ctx,                                          rsa->_method_mod_q)            /* r1 = I mod p */            || !bn_from_mont_fixed_top(r1, I, rsa->_method_mod_p, ctx)            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)            /* r1 = r1^dmp1 mod p */            || !BN_mod_exp_mont_consttime(r1, r1, rsa->dmp1, rsa->p, ctx,                                          rsa->_method_mod_p)            /* r1 = (r1 - m1) mod p */            /*             * bn_mod_sub_fixed_top is not regular modular subtraction,             * it can tolerate subtrahend to be larger than modulus, but             * not bit-wise wider. This makes up for uncommon q>p case,             * when |m1| can be larger than |rsa->p|.             */            || !bn_mod_sub_fixed_top(r1, r1, m1, rsa->p)            /* r1 = r1 * iqmp mod p */            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)            || !bn_mul_mont_fixed_top(r1, r1, rsa->iqmp, rsa->_method_mod_p,                                      ctx)            /* r0 = r1 * q + m1 */            || !bn_mul_fixed_top(r0, r1, rsa->q, ctx)            || !bn_mod_add_fixed_top(r0, r0, m1, rsa->n))            goto err;//.........这里部分代码省略.........