kris
/
boringssl
1
0
Форкнуть 0
Код Задачи 0 Pull Request'ы 0 Релизы 0 Вики Активность
Вы не можете выбрать более 25 тем Темы должны начинаться с буквы или цифры, могут содержать дефисы(-) и должны содержать не более 35 символов.
255 коммитов
12 Ветки
38 MiB
 
 
 
 
 
 
Дерево: 019c3cc64a
Ветки Теги
${ item.name }
Создать ветку ${ searchTerm }
из '019c3cc64a'
${ noResults }
boringssl/crypto/bn/bn_test.c

1409 строки
32 KiB
Исходник Вина История 

  1. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

  2.  * All rights reserved.

  3.  *

  4.  * This package is an SSL implementation written

  5.  * by Eric Young (eay@cryptsoft.com).

  6.  * The implementation was written so as to conform with Netscapes SSL.

  7.  *

  8.  * This library is free for commercial and non-commercial use as long as

  9.  * the following conditions are aheared to.  The following conditions

  10.  * apply to all code found in this distribution, be it the RC4, RSA,

  11.  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

  12.  * included with this distribution is covered by the same copyright terms

  13.  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

  14.  *

  15.  * Copyright remains Eric Young's, and as such any Copyright notices in

  16.  * the code are not to be removed.

  17.  * If this package is used in a product, Eric Young should be given attribution

  18.  * as the author of the parts of the library used.

  19.  * This can be in the form of a textual message at program startup or

  20.  * in documentation (online or textual) provided with the package.

  21.  *

  22.  * Redistribution and use in source and binary forms, with or without

  23.  * modification, are permitted provided that the following conditions

  24.  * are met:

  25.  * 1. Redistributions of source code must retain the copyright

  26.  *    notice, this list of conditions and the following disclaimer.

  27.  * 2. Redistributions in binary form must reproduce the above copyright

  28.  *    notice, this list of conditions and the following disclaimer in the

  29.  *    documentation and/or other materials provided with the distribution.

  30.  * 3. All advertising materials mentioning features or use of this software

  31.  *    must display the following acknowledgement:

  32.  *    "This product includes cryptographic software written by

  33.  *     Eric Young (eay@cryptsoft.com)"

  34.  *    The word 'cryptographic' can be left out if the rouines from the library

  35.  *    being used are not cryptographic related :-).

  36.  * 4. If you include any Windows specific code (or a derivative thereof) from

  37.  *    the apps directory (application code) you must include an acknowledgement:

  38.  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

  39.  *

  40.  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

  41.  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

  42.  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

  43.  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

  44.  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

  45.  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

  46.  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

  47.  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

  48.  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

  49.  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

  50.  * SUCH DAMAGE.

  51.  *

  52.  * The licence and distribution terms for any publically available version or

  53.  * derivative of this code cannot be changed.  i.e. this code cannot simply be

  54.  * copied and put under another distribution licence

  55.  * [including the GNU Public Licence.]

  56.  */

  57. /* ====================================================================

  58.  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.

  59.  *

  60.  * Portions of the attached software ("Contribution") are developed by

  61.  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.

  62.  *

  63.  * The Contribution is licensed pursuant to the Eric Young open source

  64.  * license provided above.

  65.  *

  66.  * The binary polynomial arithmetic software is originally written by

  67.  * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems

  68.  * Laboratories. */

  69. 

  70. #include <stdio.h>

  71. 

  72. #include <openssl/bio.h>

  73. #include <openssl/bn.h>

  74. #include <openssl/err.h>

  75. #include <openssl/mem.h>

  76. 

  77. #include "internal.h"

  78. 

  79. static const int num0 = 100; /* number of tests */

  80. static const int num1 = 50;  /* additional tests for some functions */

  81. static const int num2 = 5;   /* number of tests for slow functions */

  82. 

  83. int test_add(BIO *bp);

  84. int test_sub(BIO *bp);

  85. int test_lshift1(BIO *bp);

  86. int test_lshift(BIO *bp, BN_CTX *ctx, BIGNUM *a_);

  87. int test_rshift1(BIO *bp);

  88. int test_rshift(BIO *bp, BN_CTX *ctx);

  89. int test_sqr(BIO *bp, BN_CTX *ctx);

  90. int test_mul(BIO *bp);

  91. int test_div(BIO *bp, BN_CTX *ctx);

  92. int rand_neg(void);

  93. 

  94. int test_div_word(BIO *bp);

  95. int test_mont(BIO *bp, BN_CTX *ctx);

  96. int test_mod(BIO *bp, BN_CTX *ctx);

  97. int test_mod_mul(BIO *bp, BN_CTX *ctx);

  98. int test_mod_exp(BIO *bp, BN_CTX *ctx);

  99. int test_mod_exp_mont_consttime(BIO *bp, BN_CTX *ctx);

  100. int test_exp(BIO *bp, BN_CTX *ctx);

  101. int test_mod_sqrt(BIO *bp, BN_CTX *ctx);

  102. static int test_exp_mod_zero();

  103. int test_small_prime(BIO *bp,BN_CTX *ctx);

  104. int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx);

  105. int test_sqrt(BIO *bp, BN_CTX *ctx);

  106. int test_bn2bin_padded(BIO *bp, BN_CTX *ctx);

  107. #if 0

  108. int test_gf2m_add(BIO *bp);

  109. int test_gf2m_mod(BIO *bp);

  110. int test_gf2m_mod_mul(BIO *bp, BN_CTX *ctx);

  111. int test_gf2m_mod_sqr(BIO *bp, BN_CTX *ctx);

  112. int test_gf2m_mod_inv(BIO *bp, BN_CTX *ctx);

  113. int test_gf2m_mod_div(BIO *bp, BN_CTX *ctx);

  114. int test_gf2m_mod_exp(BIO *bp, BN_CTX *ctx);

  115. int test_gf2m_mod_sqrt(BIO *bp, BN_CTX *ctx);

  116. int test_gf2m_mod_solve_quad(BIO *bp, BN_CTX *ctx);

  117. #endif

  118. static int results = 0;

  119. 

  120. static unsigned char lst[] =

  121.     "\xC6\x4F\x43\x04\x2A\xEA\xCA\x6E\x58\x36\x80\x5B\xE8\xC9"

  122.     "\x9B\x04\x5D\x48\x36\xC2\xFD\x16\xC9\x64\xF0";

  123. 

  124. static void ERR_print_errors_fp(FILE *out) {

  125. }

  126. 

  127. static void message(BIO *out, char *m) {

  128.   BIO_puts(out, "print \"test ");

  129.   BIO_puts(out, m);

  130.   BIO_puts(out, "\\n\"\n");

  131. }

  132. 

  133. int main(int argc, char *argv[]) {

  134.   BN_CTX *ctx;

  135.   BIO *out = NULL;

  136.   char *outfile = NULL;

  137. 

  138.   results = 0;

  139. 

  140.   argc--;

  141.   argv++;

  142.   while (argc >= 1) {

  143.     if (strcmp(*argv, "-results") == 0)

  144.       results = 1;

  145.     else if (strcmp(*argv, "-out") == 0) {

  146.       if (--argc < 1)

  147.         break;

  148.       outfile = *(++argv);

  149.     }

  150.     argc--;

  151.     argv++;

  152.   }

  153. 

  154. 

  155.   ctx = BN_CTX_new();

  156.   if (ctx == NULL)

  157.     return 1;

  158. 

  159.   out = BIO_new(BIO_s_file());

  160.   if (out == NULL) {

  161.     return 1;

  162.   }

  163. 

  164.   if (outfile == NULL) {

  165.     BIO_set_fp(out, stdout, BIO_NOCLOSE);

  166.   } else {

  167.     if (!BIO_write_filename(out, outfile)) {

  168.       perror(outfile);

  169.       return 1;

  170.     }

  171.   }

  172. 

  173.   if (!results)

  174.     BIO_puts(out, "obase=16\nibase=16\n");

  175. 

  176.   message(out, "BN_add");

  177.   if (!test_add(out))

  178.     goto err;

  179.   (void)BIO_flush(out);

  180. 

  181.   message(out, "BN_sub");

  182.   if (!test_sub(out))

  183.     goto err;

  184.   (void)BIO_flush(out);

  185. 

  186.   message(out, "BN_lshift1");

  187.   if (!test_lshift1(out))

  188.     goto err;

  189.   (void)BIO_flush(out);

  190. 

  191.   message(out, "BN_lshift (fixed)");

  192.   if (!test_lshift(out, ctx, BN_bin2bn(lst, sizeof(lst) - 1, NULL)))

  193.     goto err;

  194.   (void)BIO_flush(out);

  195. 

  196.   message(out, "BN_lshift");

  197.   if (!test_lshift(out, ctx, NULL))

  198.     goto err;

  199.   (void)BIO_flush(out);

  200. 

  201.   message(out, "BN_rshift1");

  202.   if (!test_rshift1(out))

  203.     goto err;

  204.   (void)BIO_flush(out);

  205. 

  206.   message(out, "BN_rshift");

  207.   if (!test_rshift(out, ctx))

  208.     goto err;

  209.   (void)BIO_flush(out);

  210. 

  211.   message(out, "BN_sqr");

  212.   if (!test_sqr(out, ctx))

  213.     goto err;

  214.   (void)BIO_flush(out);

  215. 

  216.   message(out, "BN_mul");

  217.   if (!test_mul(out))

  218.     goto err;

  219.   (void)BIO_flush(out);

  220. 

  221.   message(out, "BN_div");

  222.   if (!test_div(out, ctx))

  223.     goto err;

  224.   (void)BIO_flush(out);

  225. 

  226.   message(out, "BN_div_word");

  227.   if (!test_div_word(out))

  228.     goto err;

  229.   (void)BIO_flush(out);

  230. 

  231.   message(out, "BN_mod");

  232.   if (!test_mod(out, ctx))

  233.     goto err;

  234.   (void)BIO_flush(out);

  235. 

  236.   message(out, "BN_mod_mul");

  237.   if (!test_mod_mul(out, ctx))

  238.     goto err;

  239.   (void)BIO_flush(out);

  240. 

  241.   message(out, "BN_mont");

  242.   if (!test_mont(out, ctx))

  243.     goto err;

  244.   (void)BIO_flush(out);

  245. 

  246.   message(out, "BN_mod_exp");

  247.   if (!test_mod_exp(out, ctx))

  248.     goto err;

  249.   (void)BIO_flush(out);

  250. 

  251.   message(out, "BN_mod_exp_mont_consttime");

  252.   if (!test_mod_exp_mont_consttime(out, ctx) ||

  253.       !test_mod_exp_mont5(out, ctx)) {

  254.     goto err;

  255.   }

  256.   (void)BIO_flush(out);

  257. 

  258.   message(out, "BN_exp");

  259.   if (!test_exp(out, ctx) ||

  260.       !test_exp_mod_zero()) {

  261.     goto err;

  262.   }

  263.   (void)BIO_flush(out);

  264. 

  265.   message(out, "BN_mod_sqrt");

  266.   if (!test_mod_sqrt(out, ctx))

  267.     goto err;

  268.   (void)BIO_flush(out);

  269. 

  270.   message(out, "Small prime generation");

  271.   if (!test_small_prime(out, ctx))

  272.     goto err;

  273.   (void)BIO_flush(out);

  274. 

  275.   message(out, "BN_sqrt");

  276.   if (!test_sqrt(out, ctx))

  277.     goto err;

  278.   (void)BIO_flush(out);

  279. 

  280.   message(out, "BN_bn2bin_padded");

  281.   if (!test_bn2bin_padded(out, ctx))

  282.     goto err;

  283.   (void)BIO_flush(out);

  284. 

  285.   BN_CTX_free(ctx);

  286.   BIO_free(out);

  287. 

  288.   printf("PASS\n");

  289.   return 0;

  290. 

  291. err:

  292.   BIO_puts(out, "1\n"); /* make sure the Perl script fed by bc notices

  293.                          * the failure, see test_bn in test/Makefile.ssl*/

  294.   (void)BIO_flush(out);

  295. 

  296.   return 1;

  297. }

  298. 

  299. int test_add(BIO *bp) {

  300.   BIGNUM a, b, c;

  301.   int i;

  302. 

  303.   BN_init(&a);

  304.   BN_init(&b);

  305.   BN_init(&c);

  306. 

  307.   BN_rand(&a, 512, 0, 0);

  308.   for (i = 0; i < num0; i++) {

  309.     BN_rand(&b, 450 + i, 0, 0);

  310.     a.neg = rand_neg();

  311.     b.neg = rand_neg();

  312.     BN_add(&c, &a, &b);

  313.     if (bp != NULL) {

  314.       if (!results) {

  315.         BN_print(bp, &a);

  316.         BIO_puts(bp, " + ");

  317.         BN_print(bp, &b);

  318.         BIO_puts(bp, " - ");

  319.       }

  320.       BN_print(bp, &c);

  321.       BIO_puts(bp, "\n");

  322.     }

  323.     a.neg = !a.neg;

  324.     b.neg = !b.neg;

  325.     BN_add(&c, &c, &b);

  326.     BN_add(&c, &c, &a);

  327.     if (!BN_is_zero(&c)) {

  328.       fprintf(stderr, "Add test failed!\n");

  329.       return 0;

  330.     }

  331.   }

  332.   BN_free(&a);

  333.   BN_free(&b);

  334.   BN_free(&c);

  335.   return (1);

  336. }

  337. 

  338. int test_sub(BIO *bp) {

  339.   BIGNUM a, b, c;

  340.   int i;

  341. 

  342.   BN_init(&a);

  343.   BN_init(&b);

  344.   BN_init(&c);

  345. 

  346.   for (i = 0; i < num0 + num1; i++) {

  347.     if (i < num1) {

  348.       BN_rand(&a, 512, 0, 0);

  349.       BN_copy(&b, &a);

  350.       if (BN_set_bit(&a, i) == 0)

  351.         return (0);

  352.       BN_add_word(&b, i);

  353.     } else {

  354.       BN_rand(&b, 400 + i - num1, 0, 0);

  355.       a.neg = rand_neg();

  356.       b.neg = rand_neg();

  357.     }

  358.     BN_sub(&c, &a, &b);

  359.     if (bp != NULL) {

  360.       if (!results) {

  361.         BN_print(bp, &a);

  362.         BIO_puts(bp, " - ");

  363.         BN_print(bp, &b);

  364.         BIO_puts(bp, " - ");

  365.       }

  366.       BN_print(bp, &c);

  367.       BIO_puts(bp, "\n");

  368.     }

  369.     BN_add(&c, &c, &b);

  370.     BN_sub(&c, &c, &a);

  371.     if (!BN_is_zero(&c)) {

  372.       fprintf(stderr, "Subtract test failed!\n");

  373.       return 0;

  374.     }

  375.   }

  376.   BN_free(&a);

  377.   BN_free(&b);

  378.   BN_free(&c);

  379.   return (1);

  380. }

  381. 

  382. int test_div(BIO *bp, BN_CTX *ctx) {

  383.   BIGNUM a, b, c, d, e;

  384.   int i;

  385. 

  386.   BN_init(&a);

  387.   BN_init(&b);

  388.   BN_init(&c);

  389.   BN_init(&d);

  390.   BN_init(&e);

  391. 

  392.   for (i = 0; i < num0 + num1; i++) {

  393.     if (i < num1) {

  394.       BN_rand(&a, 400, 0, 0);

  395.       BN_copy(&b, &a);

  396.       BN_lshift(&a, &a, i);

  397.       BN_add_word(&a, i);

  398.     } else

  399.       BN_rand(&b, 50 + 3 * (i - num1), 0, 0);

  400.     a.neg = rand_neg();

  401.     b.neg = rand_neg();

  402.     BN_div(&d, &c, &a, &b, ctx);

  403.     if (bp != NULL) {

  404.       if (!results) {

  405.         BN_print(bp, &a);

  406.         BIO_puts(bp, " / ");

  407.         BN_print(bp, &b);

  408.         BIO_puts(bp, " - ");

  409.       }

  410.       BN_print(bp, &d);

  411.       BIO_puts(bp, "\n");

  412. 

  413.       if (!results) {

  414.         BN_print(bp, &a);

  415.         BIO_puts(bp, " % ");

  416.         BN_print(bp, &b);

  417.         BIO_puts(bp, " - ");

  418.       }

  419.       BN_print(bp, &c);

  420.       BIO_puts(bp, "\n");

  421.     }

  422.     BN_mul(&e, &d, &b, ctx);

  423.     BN_add(&d, &e, &c);

  424.     BN_sub(&d, &d, &a);

  425.     if (!BN_is_zero(&d)) {

  426.       fprintf(stderr, "Division test failed!\n");

  427.       return 0;

  428.     }

  429.   }

  430.   BN_free(&a);

  431.   BN_free(&b);

  432.   BN_free(&c);

  433.   BN_free(&d);

  434.   BN_free(&e);

  435.   return (1);

  436. }

  437. 

  438. int test_lshift1(BIO *bp) {

  439.   BIGNUM *a, *b, *c;

  440.   int i;

  441. 

  442.   a = BN_new();

  443.   b = BN_new();

  444.   c = BN_new();

  445. 

  446.   BN_rand(a, 200, 0, 0); /**/

  447.   a->neg = rand_neg();

  448.   for (i = 0; i < num0; i++) {

  449.     BN_lshift1(b, a);

  450.     if (bp != NULL) {

  451.       if (!results) {

  452.         BN_print(bp, a);

  453.         BIO_puts(bp, " * 2");

  454.         BIO_puts(bp, " - ");

  455.       }

  456.       BN_print(bp, b);

  457.       BIO_puts(bp, "\n");

  458.     }

  459.     BN_add(c, a, a);

  460.     BN_sub(a, b, c);

  461.     if (!BN_is_zero(a)) {

  462.       fprintf(stderr, "Left shift one test failed!\n");

  463.       return 0;

  464.     }

  465. 

  466.     BN_copy(a, b);

  467.   }

  468.   BN_free(a);

  469.   BN_free(b);

  470.   BN_free(c);

  471.   return (1);

  472. }

  473. 

  474. int test_rshift(BIO *bp, BN_CTX *ctx) {

  475.   BIGNUM *a, *b, *c, *d, *e;

  476.   int i;

  477. 

  478.   a = BN_new();

  479.   b = BN_new();

  480.   c = BN_new();

  481.   d = BN_new();

  482.   e = BN_new();

  483.   BN_one(c);

  484. 

  485.   BN_rand(a, 200, 0, 0); /**/

  486.   a->neg = rand_neg();

  487.   for (i = 0; i < num0; i++) {

  488.     BN_rshift(b, a, i + 1);

  489.     BN_add(c, c, c);

  490.     if (bp != NULL) {

  491.       if (!results) {

  492.         BN_print(bp, a);

  493.         BIO_puts(bp, " / ");

  494.         BN_print(bp, c);

  495.         BIO_puts(bp, " - ");

  496.       }

  497.       BN_print(bp, b);

  498.       BIO_puts(bp, "\n");

  499.     }

  500.     BN_div(d, e, a, c, ctx);

  501.     BN_sub(d, d, b);

  502.     if (!BN_is_zero(d)) {

  503.       fprintf(stderr, "Right shift test failed!\n");

  504.       return 0;

  505.     }

  506.   }

  507.   BN_free(a);

  508.   BN_free(b);

  509.   BN_free(c);

  510.   BN_free(d);

  511.   BN_free(e);

  512.   return (1);

  513. }

  514. 

  515. int test_rshift1(BIO *bp) {

  516.   BIGNUM *a, *b, *c;

  517.   int i;

  518. 

  519.   a = BN_new();

  520.   b = BN_new();

  521.   c = BN_new();

  522. 

  523.   BN_rand(a, 200, 0, 0); /**/

  524.   a->neg = rand_neg();

  525.   for (i = 0; i < num0; i++) {

  526.     BN_rshift1(b, a);

  527.     if (bp != NULL) {

  528.       if (!results) {

  529.         BN_print(bp, a);

  530.         BIO_puts(bp, " / 2");

  531.         BIO_puts(bp, " - ");

  532.       }

  533.       BN_print(bp, b);

  534.       BIO_puts(bp, "\n");

  535.     }

  536.     BN_sub(c, a, b);

  537.     BN_sub(c, c, b);

  538.     if (!BN_is_zero(c) && !BN_abs_is_word(c, 1)) {

  539.       fprintf(stderr, "Right shift one test failed!\n");

  540.       return 0;

  541.     }

  542.     BN_copy(a, b);

  543.   }

  544.   BN_free(a);

  545.   BN_free(b);

  546.   BN_free(c);

  547.   return (1);

  548. }

  549. 

  550. int test_lshift(BIO *bp, BN_CTX *ctx, BIGNUM *a_) {

  551.   BIGNUM *a, *b, *c, *d;

  552.   int i;

  553. 

  554.   b = BN_new();

  555.   c = BN_new();

  556.   d = BN_new();

  557.   BN_one(c);

  558. 

  559.   if (a_)

  560.     a = a_;

  561.   else {

  562.     a = BN_new();

  563.     BN_rand(a, 200, 0, 0); /**/

  564.     a->neg = rand_neg();

  565.   }

  566.   for (i = 0; i < num0; i++) {

  567.     BN_lshift(b, a, i + 1);

  568.     BN_add(c, c, c);

  569.     if (bp != NULL) {

  570.       if (!results) {

  571.         BN_print(bp, a);

  572.         BIO_puts(bp, " * ");

  573.         BN_print(bp, c);

  574.         BIO_puts(bp, " - ");

  575.       }

  576.       BN_print(bp, b);

  577.       BIO_puts(bp, "\n");

  578.     }

  579.     BN_mul(d, a, c, ctx);

  580.     BN_sub(d, d, b);

  581.     if (!BN_is_zero(d)) {

  582.       fprintf(stderr, "Left shift test failed!\n");

  583.       fprintf(stderr, "a=");

  584.       BN_print_fp(stderr, a);

  585.       fprintf(stderr, "\nb=");

  586.       BN_print_fp(stderr, b);

  587.       fprintf(stderr, "\nc=");

  588.       BN_print_fp(stderr, c);

  589.       fprintf(stderr, "\nd=");

  590.       BN_print_fp(stderr, d);

  591.       fprintf(stderr, "\n");

  592.       return 0;

  593.     }

  594.   }

  595.   BN_free(a);

  596.   BN_free(b);

  597.   BN_free(c);

  598.   BN_free(d);

  599.   return (1);

  600. }

  601. 

  602. int test_mul(BIO *bp) {

  603.   BIGNUM a, b, c, d, e;

  604.   int i;

  605.   BN_CTX *ctx;

  606. 

  607.   ctx = BN_CTX_new();

  608.   if (ctx == NULL)

  609.     abort();

  610. 

  611.   BN_init(&a);

  612.   BN_init(&b);

  613.   BN_init(&c);

  614.   BN_init(&d);

  615.   BN_init(&e);

  616. 

  617.   for (i = 0; i < num0 + num1; i++) {

  618.     if (i <= num1) {

  619.       BN_rand(&a, 100, 0, 0);

  620.       BN_rand(&b, 100, 0, 0);

  621.     } else

  622.       BN_rand(&b, i - num1, 0, 0);

  623.     a.neg = rand_neg();

  624.     b.neg = rand_neg();

  625.     BN_mul(&c, &a, &b, ctx);

  626.     if (bp != NULL) {

  627.       if (!results) {

  628.         BN_print(bp, &a);

  629.         BIO_puts(bp, " * ");

  630.         BN_print(bp, &b);

  631.         BIO_puts(bp, " - ");

  632.       }

  633.       BN_print(bp, &c);

  634.       BIO_puts(bp, "\n");

  635.     }

  636.     BN_div(&d, &e, &c, &a, ctx);

  637.     BN_sub(&d, &d, &b);

  638.     if (!BN_is_zero(&d) || !BN_is_zero(&e)) {

  639.       fprintf(stderr, "Multiplication test failed!\n");

  640.       return 0;

  641.     }

  642.   }

  643.   BN_free(&a);

  644.   BN_free(&b);

  645.   BN_free(&c);

  646.   BN_free(&d);

  647.   BN_free(&e);

  648.   BN_CTX_free(ctx);

  649.   return (1);

  650. }

  651. 

  652. int test_sqr(BIO *bp, BN_CTX *ctx) {

  653.   BIGNUM a, c, d, e;

  654.   int i;

  655. 

  656.   BN_init(&a);

  657.   BN_init(&c);

  658.   BN_init(&d);

  659.   BN_init(&e);

  660. 

  661.   for (i = 0; i < num0; i++) {

  662.     BN_rand(&a, 40 + i * 10, 0, 0);

  663.     a.neg = rand_neg();

  664.     BN_sqr(&c, &a, ctx);

  665.     if (bp != NULL) {

  666.       if (!results) {

  667.         BN_print(bp, &a);

  668.         BIO_puts(bp, " * ");

  669.         BN_print(bp, &a);

  670.         BIO_puts(bp, " - ");

  671.       }

  672.       BN_print(bp, &c);

  673.       BIO_puts(bp, "\n");

  674.     }

  675.     BN_div(&d, &e, &c, &a, ctx);

  676.     BN_sub(&d, &d, &a);

  677.     if (!BN_is_zero(&d) || !BN_is_zero(&e)) {

  678.       fprintf(stderr, "Square test failed!\n");

  679.       return 0;

  680.     }

  681.   }

  682.   BN_free(&a);

  683.   BN_free(&c);

  684.   BN_free(&d);

  685.   BN_free(&e);

  686.   return (1);

  687. }

  688. 

  689. 

  690. int rand_neg(void) {

  691.   static unsigned int neg = 0;

  692.   static int sign[8] = {0, 0, 0, 1, 1, 0, 1, 1};

  693. 

  694.   return (sign[(neg++) % 8]);

  695. }

  696. 

  697. static void print_word(BIO *bp, BN_ULONG w) {

  698.   BIO_printf(bp, BN_HEX_FMT1, w);

  699. }

  700. 

  701. int test_div_word(BIO *bp) {

  702.   BIGNUM a, b;

  703.   BN_ULONG r, s;

  704.   int i;

  705. 

  706.   BN_init(&a);

  707.   BN_init(&b);

  708. 

  709.   for (i = 0; i < num0; i++) {

  710.     do {

  711.       BN_rand(&a, 512, -1, 0);

  712.       BN_rand(&b, BN_BITS2, -1, 0);

  713.       s = b.d[0];

  714.     } while (!s);

  715. 

  716.     BN_copy(&b, &a);

  717.     r = BN_div_word(&b, s);

  718. 

  719.     if (bp != NULL) {

  720.       if (!results) {

  721.         BN_print(bp, &a);

  722.         BIO_puts(bp, " / ");

  723.         print_word(bp, s);

  724.         BIO_puts(bp, " - ");

  725.       }

  726.       BN_print(bp, &b);

  727.       BIO_puts(bp, "\n");

  728. 

  729.       if (!results) {

  730.         BN_print(bp, &a);

  731.         BIO_puts(bp, " % ");

  732.         print_word(bp, s);

  733.         BIO_puts(bp, " - ");

  734.       }

  735.       print_word(bp, r);

  736.       BIO_puts(bp, "\n");

  737.     }

  738.     BN_mul_word(&b, s);

  739.     BN_add_word(&b, r);

  740.     BN_sub(&b, &a, &b);

  741.     if (!BN_is_zero(&b)) {

  742.       fprintf(stderr, "Division (word) test failed!\n");

  743.       return 0;

  744.     }

  745.   }

  746.   BN_free(&a);

  747.   BN_free(&b);

  748.   return (1);

  749. }

  750. 

  751. int test_mont(BIO *bp, BN_CTX *ctx) {

  752.   BIGNUM a, b, c, d, A, B;

  753.   BIGNUM n;

  754.   int i;

  755.   BN_MONT_CTX *mont;

  756. 

  757.   BN_init(&a);

  758.   BN_init(&b);

  759.   BN_init(&c);

  760.   BN_init(&d);

  761.   BN_init(&A);

  762.   BN_init(&B);

  763.   BN_init(&n);

  764. 

  765.   mont = BN_MONT_CTX_new();

  766.   if (mont == NULL)

  767.     return 0;

  768. 

  769.   BN_rand(&a, 100, 0, 0); /**/

  770.   BN_rand(&b, 100, 0, 0); /**/

  771.   for (i = 0; i < num2; i++) {

  772.     int bits = (200 * (i + 1)) / num2;

  773. 

  774.     if (bits == 0)

  775.       continue;

  776.     BN_rand(&n, bits, 0, 1);

  777.     BN_MONT_CTX_set(mont, &n, ctx);

  778. 

  779.     BN_nnmod(&a, &a, &n, ctx);

  780.     BN_nnmod(&b, &b, &n, ctx);

  781. 

  782.     BN_to_montgomery(&A, &a, mont, ctx);

  783.     BN_to_montgomery(&B, &b, mont, ctx);

  784. 

  785.     BN_mod_mul_montgomery(&c, &A, &B, mont, ctx); /**/

  786.     BN_from_montgomery(&A, &c, mont, ctx);        /**/

  787.     if (bp != NULL) {

  788.       if (!results) {

  789. #ifdef undef

  790.         fprintf(stderr, "%d * %d %% %d\n", BN_num_bits(&a), BN_num_bits(&b),

  791.                 BN_num_bits(mont->N));

  792. #endif

  793.         BN_print(bp, &a);

  794.         BIO_puts(bp, " * ");

  795.         BN_print(bp, &b);

  796.         BIO_puts(bp, " % ");

  797.         BN_print(bp, &(mont->N));

  798.         BIO_puts(bp, " - ");

  799.       }

  800.       BN_print(bp, &A);

  801.       BIO_puts(bp, "\n");

  802.     }

  803.     BN_mod_mul(&d, &a, &b, &n, ctx);

  804.     BN_sub(&d, &d, &A);

  805.     if (!BN_is_zero(&d)) {

  806.       fprintf(stderr, "Montgomery multiplication test failed!\n");

  807.       return 0;

  808.     }

  809.   }

  810.   BN_MONT_CTX_free(mont);

  811.   BN_free(&a);

  812.   BN_free(&b);

  813.   BN_free(&c);

  814.   BN_free(&d);

  815.   BN_free(&A);

  816.   BN_free(&B);

  817.   BN_free(&n);

  818.   return (1);

  819. }

  820. 

  821. int test_mod(BIO *bp, BN_CTX *ctx) {

  822.   BIGNUM *a, *b, *c, *d, *e;

  823.   int i;

  824. 

  825.   a = BN_new();

  826.   b = BN_new();

  827.   c = BN_new();

  828.   d = BN_new();

  829.   e = BN_new();

  830. 

  831.   BN_rand(a, 1024, 0, 0); /**/

  832.   for (i = 0; i < num0; i++) {

  833.     BN_rand(b, 450 + i * 10, 0, 0); /**/

  834.     a->neg = rand_neg();

  835.     b->neg = rand_neg();

  836.     BN_mod(c, a, b, ctx); /**/

  837.     if (bp != NULL) {

  838.       if (!results) {

  839.         BN_print(bp, a);

  840.         BIO_puts(bp, " % ");

  841.         BN_print(bp, b);

  842.         BIO_puts(bp, " - ");

  843.       }

  844.       BN_print(bp, c);

  845.       BIO_puts(bp, "\n");

  846.     }

  847.     BN_div(d, e, a, b, ctx);

  848.     BN_sub(e, e, c);

  849.     if (!BN_is_zero(e)) {

  850.       fprintf(stderr, "Modulo test failed!\n");

  851.       return 0;

  852.     }

  853.   }

  854.   BN_free(a);

  855.   BN_free(b);

  856.   BN_free(c);

  857.   BN_free(d);

  858.   BN_free(e);

  859.   return (1);

  860. }

  861. 

  862. int test_mod_mul(BIO *bp, BN_CTX *ctx) {

  863.   BIGNUM *a, *b, *c, *d, *e;

  864.   int i, j;

  865. 

  866.   a = BN_new();

  867.   b = BN_new();

  868.   c = BN_new();

  869.   d = BN_new();

  870.   e = BN_new();

  871. 

  872.   for (j = 0; j < 3; j++) {

  873.     BN_rand(c, 1024, 0, 0); /**/

  874.     for (i = 0; i < num0; i++) {

  875.       BN_rand(a, 475 + i * 10, 0, 0); /**/

  876.       BN_rand(b, 425 + i * 11, 0, 0); /**/

  877.       a->neg = rand_neg();

  878.       b->neg = rand_neg();

  879.       if (!BN_mod_mul(e, a, b, c, ctx)) {

  880.         unsigned long l;

  881. 

  882.         while ((l = ERR_get_error()))

  883.           fprintf(stderr, "ERROR:%s\n", ERR_error_string(l, NULL));

  884.         abort();

  885.       }

  886.       if (bp != NULL) {

  887.         if (!results) {

  888.           BN_print(bp, a);

  889.           BIO_puts(bp, " * ");

  890.           BN_print(bp, b);

  891.           BIO_puts(bp, " % ");

  892.           BN_print(bp, c);

  893.           if ((a->neg ^ b->neg) && !BN_is_zero(e)) {

  894.             /* If  (a*b) % c  is negative,  c  must be added

  895.              * in order to obtain the normalized remainder

  896.              * (new with OpenSSL 0.9.7, previous versions of

  897.              * BN_mod_mul could generate negative results)

  898.              */

  899.             BIO_puts(bp, " + ");

  900.             BN_print(bp, c);

  901.           }

  902.           BIO_puts(bp, " - ");

  903.         }

  904.         BN_print(bp, e);

  905.         BIO_puts(bp, "\n");

  906.       }

  907.       BN_mul(d, a, b, ctx);

  908.       BN_sub(d, d, e);

  909.       BN_div(a, b, d, c, ctx);

  910.       if (!BN_is_zero(b)) {

  911.         fprintf(stderr, "Modulo multiply test failed!\n");

  912.         ERR_print_errors_fp(stderr);

  913.         return 0;

  914.       }

  915.     }

  916.   }

  917.   BN_free(a);

  918.   BN_free(b);

  919.   BN_free(c);

  920.   BN_free(d);

  921.   BN_free(e);

  922.   return (1);

  923. }

  924. 

  925. int test_mod_exp(BIO *bp, BN_CTX *ctx) {

  926.   BIGNUM *a, *b, *c, *d, *e;

  927.   int i;

  928. 

  929.   a = BN_new();

  930.   b = BN_new();

  931.   c = BN_new();

  932.   d = BN_new();

  933.   e = BN_new();

  934. 

  935.   BN_rand(c, 30, 0, 1); /* must be odd for montgomery */

  936.   for (i = 0; i < num2; i++) {

  937.     BN_rand(a, 20 + i * 5, 0, 0); /**/

  938.     BN_rand(b, 2 + i, 0, 0);      /**/

  939. 

  940.     if (!BN_mod_exp(d, a, b, c, ctx))

  941.       return (0);

  942. 

  943.     if (bp != NULL) {

  944.       if (!results) {

  945.         BN_print(bp, a);

  946.         BIO_puts(bp, " ^ ");

  947.         BN_print(bp, b);

  948.         BIO_puts(bp, " % ");

  949.         BN_print(bp, c);

  950.         BIO_puts(bp, " - ");

  951.       }

  952.       BN_print(bp, d);

  953.       BIO_puts(bp, "\n");

  954.     }

  955.     BN_exp(e, a, b, ctx);

  956.     BN_sub(e, e, d);

  957.     BN_div(a, b, e, c, ctx);

  958.     if (!BN_is_zero(b)) {

  959.       fprintf(stderr, "Modulo exponentiation test failed!\n");

  960.       return 0;

  961.     }

  962.   }

  963.   BN_free(a);

  964.   BN_free(b);

  965.   BN_free(c);

  966.   BN_free(d);

  967.   BN_free(e);

  968.   return (1);

  969. }

  970. 

  971. int test_mod_exp_mont_consttime(BIO *bp, BN_CTX *ctx) {

  972.   BIGNUM *a, *b, *c, *d, *e;

  973.   int i;

  974. 

  975.   a = BN_new();

  976.   b = BN_new();

  977.   c = BN_new();

  978.   d = BN_new();

  979.   e = BN_new();

  980. 

  981.   BN_rand(c, 30, 0, 1); /* must be odd for montgomery */

  982.   for (i = 0; i < num2; i++) {

  983.     BN_rand(a, 20 + i * 5, 0, 0); /**/

  984.     BN_rand(b, 2 + i, 0, 0);      /**/

  985. 

  986.     if (!BN_mod_exp_mont_consttime(d, a, b, c, ctx, NULL))

  987.       return (00);

  988. 

  989.     if (bp != NULL) {

  990.       if (!results) {

  991.         BN_print(bp, a);

  992.         BIO_puts(bp, " ^ ");

  993.         BN_print(bp, b);

  994.         BIO_puts(bp, " % ");

  995.         BN_print(bp, c);

  996.         BIO_puts(bp, " - ");

  997.       }

  998.       BN_print(bp, d);

  999.       BIO_puts(bp, "\n");

  1000.     }

  1001.     BN_exp(e, a, b, ctx);

  1002.     BN_sub(e, e, d);

  1003.     BN_div(a, b, e, c, ctx);

  1004.     if (!BN_is_zero(b)) {

  1005.       fprintf(stderr, "Modulo exponentiation test failed!\n");

  1006.       return 0;

  1007.     }

  1008.   }

  1009.   BN_free(a);

  1010.   BN_free(b);

  1011.   BN_free(c);

  1012.   BN_free(d);

  1013.   BN_free(e);

  1014.   return (1);

  1015. }

  1016. 

  1017. /* Test constant-time modular exponentiation with 1024-bit inputs,

  1018.  * which on x86_64 cause a different code branch to be taken. */

  1019. int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx) {

  1020.   BIGNUM *a, *p, *m, *d, *e;

  1021. 

  1022.   BN_MONT_CTX *mont;

  1023. 

  1024.   a = BN_new();

  1025.   p = BN_new();

  1026.   m = BN_new();

  1027.   d = BN_new();

  1028.   e = BN_new();

  1029. 

  1030.   mont = BN_MONT_CTX_new();

  1031. 

  1032.   BN_rand(m, 1024, 0, 1); /* must be odd for montgomery */

  1033.   /* Zero exponent */

  1034.   BN_rand(a, 1024, 0, 0);

  1035.   BN_zero(p);

  1036.   if (!BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))

  1037.     return 0;

  1038.   if (!BN_is_one(d)) {

  1039.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1040.     return 0;

  1041.   }

  1042.   /* Zero input */

  1043.   BN_rand(p, 1024, 0, 0);

  1044.   BN_zero(a);

  1045.   if (!BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))

  1046.     return 0;

  1047.   if (!BN_is_zero(d)) {

  1048.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1049.     return 0;

  1050.   }

  1051.   /* Craft an input whose Montgomery representation is 1,

  1052.    * i.e., shorter than the modulus m, in order to test

  1053.    * the const time precomputation scattering/gathering.

  1054.    */

  1055.   BN_one(a);

  1056.   BN_MONT_CTX_set(mont, m, ctx);

  1057.   if (!BN_from_montgomery(e, a, mont, ctx) ||

  1058.       !BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL) ||

  1059.       !BN_mod_exp(a, e, p, m, ctx)) {

  1060.     return 0;

  1061.   }

  1062.   if (BN_cmp(a, d) != 0) {

  1063.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1064.     return 0;

  1065.   }

  1066.   /* Finally, some regular test vectors. */

  1067.   BN_rand(e, 1024, 0, 0);

  1068.   if (!BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))

  1069.     return 0;

  1070.   if (!BN_mod_exp(a, e, p, m, ctx))

  1071.     return 0;

  1072.   if (BN_cmp(a, d) != 0) {

  1073.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1074.     return 0;

  1075.   }

  1076. 

  1077.   BN_MONT_CTX_free(mont);

  1078.   BN_free(a);

  1079.   BN_free(p);

  1080.   BN_free(m);

  1081.   BN_free(d);

  1082.   BN_free(e);

  1083.   return (1);

  1084. }

  1085. 

  1086. int test_exp(BIO *bp, BN_CTX *ctx) {

  1087.   BIGNUM *a, *b, *d, *e, *one;

  1088.   int i;

  1089. 

  1090.   a = BN_new();

  1091.   b = BN_new();

  1092.   d = BN_new();

  1093.   e = BN_new();

  1094.   one = BN_new();

  1095.   BN_one(one);

  1096. 

  1097.   for (i = 0; i < num2; i++) {

  1098.     BN_rand(a, 20 + i * 5, 0, 0); /**/

  1099.     BN_rand(b, 2 + i, 0, 0);      /**/

  1100. 

  1101.     if (BN_exp(d, a, b, ctx) <= 0)

  1102.       return (0);

  1103. 

  1104.     if (bp != NULL) {

  1105.       if (!results) {

  1106.         BN_print(bp, a);

  1107.         BIO_puts(bp, " ^ ");

  1108.         BN_print(bp, b);

  1109.         BIO_puts(bp, " - ");

  1110.       }

  1111.       BN_print(bp, d);

  1112.       BIO_puts(bp, "\n");

  1113.     }

  1114.     BN_one(e);

  1115.     for (; !BN_is_zero(b); BN_sub(b, b, one))

  1116.       BN_mul(e, e, a, ctx);

  1117.     BN_sub(e, e, d);

  1118.     if (!BN_is_zero(e)) {

  1119.       fprintf(stderr, "Exponentiation test failed!\n");

  1120.       return 0;

  1121.     }

  1122.   }

  1123.   BN_free(a);

  1124.   BN_free(b);

  1125.   BN_free(d);

  1126.   BN_free(e);

  1127.   BN_free(one);

  1128.   return (1);

  1129. }

  1130. 

  1131. /* test_exp_mod_zero tests that x**0 mod 1 == 0. */

  1132. static int test_exp_mod_zero() {

  1133.   BIGNUM a, p, m;

  1134.   BIGNUM r;

  1135.   BN_CTX *ctx = BN_CTX_new();

  1136.   int ret = 0;

  1137. 

  1138.   BN_init(&m);

  1139.   BN_one(&m);

  1140. 

  1141.   BN_init(&a);

  1142.   BN_one(&a);

  1143. 

  1144.   BN_init(&p);

  1145.   BN_zero(&p);

  1146. 

  1147.   BN_init(&r);

  1148.   BN_mod_exp(&r, &a, &p, &m, ctx);

  1149.   BN_CTX_free(ctx);

  1150. 

  1151.   if (BN_is_zero(&r)) {

  1152.     ret = 1;

  1153.   } else {

  1154.     printf("1**0 mod 1 = ");

  1155.     BN_print_fp(stdout, &r);

  1156.     printf(", should be 0\n");

  1157.   }

  1158. 

  1159.   BN_free(&r);

  1160.   BN_free(&a);

  1161.   BN_free(&p);

  1162.   BN_free(&m);

  1163. 

  1164.   return ret;

  1165. }

  1166. 

  1167. static int genprime_cb(int p, int n, BN_GENCB *arg) {

  1168.   char c = '*';

  1169. 

  1170.   if (p == 0)

  1171.     c = '.';

  1172.   if (p == 1)

  1173.     c = '+';

  1174.   if (p == 2)

  1175.     c = '*';

  1176.   if (p == 3)

  1177.     c = '\n';

  1178.   putc(c, stdout);

  1179.   fflush(stdout);

  1180.   return 1;

  1181. }

  1182. 

  1183. int test_mod_sqrt(BIO *bp, BN_CTX *ctx) {

  1184.   BN_GENCB cb;

  1185.   BIGNUM *a, *p, *r;

  1186.   int i, j;

  1187.   int ret = 0;

  1188. 

  1189.   a = BN_new();

  1190.   p = BN_new();

  1191.   r = BN_new();

  1192.   if (a == NULL || p == NULL || r == NULL)

  1193.     goto err;

  1194. 

  1195.   BN_GENCB_set(&cb, genprime_cb, NULL);

  1196. 

  1197.   for (i = 0; i < 16; i++) {

  1198.     if (i < 8) {

  1199.       unsigned primes[8] = {2, 3, 5, 7, 11, 13, 17, 19};

  1200. 

  1201.       if (!BN_set_word(p, primes[i]))

  1202.         goto err;

  1203.     } else {

  1204.       if (!BN_set_word(a, 32))

  1205.         goto err;

  1206.       if (!BN_set_word(r, 2 * i + 1))

  1207.         goto err;

  1208. 

  1209.       if (!BN_generate_prime_ex(p, 256, 0, a, r, &cb))

  1210.         goto err;

  1211.       putc('\n', stdout);

  1212.     }

  1213.     p->neg = rand_neg();

  1214. 

  1215.     for (j = 0; j < num2; j++) {

  1216.       /* construct 'a' such that it is a square modulo p,

  1217.        * but in general not a proper square and not reduced modulo p */

  1218.       if (!BN_rand(r, 256, 0, 3))

  1219.         goto err;

  1220.       if (!BN_nnmod(r, r, p, ctx))

  1221.         goto err;

  1222.       if (!BN_mod_sqr(r, r, p, ctx))

  1223.         goto err;

  1224.       if (!BN_rand(a, 256, 0, 3))

  1225.         goto err;

  1226.       if (!BN_nnmod(a, a, p, ctx))

  1227.         goto err;

  1228.       if (!BN_mod_sqr(a, a, p, ctx))

  1229.         goto err;

  1230.       if (!BN_mul(a, a, r, ctx))

  1231.         goto err;

  1232.       if (rand_neg())

  1233.         if (!BN_sub(a, a, p))

  1234.           goto err;

  1235. 

  1236.       if (!BN_mod_sqrt(r, a, p, ctx))

  1237.         goto err;

  1238.       if (!BN_mod_sqr(r, r, p, ctx))

  1239.         goto err;

  1240. 

  1241.       if (!BN_nnmod(a, a, p, ctx))

  1242.         goto err;

  1243. 

  1244.       if (BN_cmp(a, r) != 0) {

  1245.         fprintf(stderr, "BN_mod_sqrt failed: a = ");

  1246.         BN_print_fp(stderr, a);

  1247.         fprintf(stderr, ", r = ");

  1248.         BN_print_fp(stderr, r);

  1249.         fprintf(stderr, ", p = ");

  1250.         BN_print_fp(stderr, p);

  1251.         fprintf(stderr, "\n");

  1252.         goto err;

  1253.       }

  1254. 

  1255.       putc('.', stdout);

  1256.       fflush(stdout);

  1257.     }

  1258. 

  1259.     putc('\n', stdout);

  1260.     fflush(stderr);

  1261.   }

  1262.   ret = 1;

  1263. err:

  1264.   if (a != NULL)

  1265.     BN_free(a);

  1266.   if (p != NULL)

  1267.     BN_free(p);

  1268.   if (r != NULL)

  1269.     BN_free(r);

  1270.   return ret;

  1271. }

  1272. 

  1273. int test_small_prime(BIO *bp, BN_CTX *ctx) {

  1274.   static const int bits = 10;

  1275.   int ret = 0;

  1276.   BIGNUM r;

  1277. 

  1278.   BN_init(&r);

  1279.   if (!BN_generate_prime_ex(&r, bits, 0, NULL, NULL, NULL)) {

  1280.     goto err;

  1281.   }

  1282.   if (BN_num_bits(&r) != bits) {

  1283.     BIO_printf(bp, "Expected %d bit prime, got %d bit number\n", bits,

  1284.                BN_num_bits(&r));

  1285.     goto err;

  1286.   }

  1287. 

  1288.   ret = 1;

  1289. 

  1290. err:

  1291.   BN_free(&r);

  1292.   return ret;

  1293. }

  1294. 

  1295. int test_sqrt(BIO *bp, BN_CTX *ctx) {

  1296.   BIGNUM *n = BN_new(), *nn = BN_new(), *sqrt = BN_new();

  1297.   unsigned i;

  1298. 

  1299.   /* Test some random squares. */

  1300.   for (i = 0; i < 100; i++) {

  1301.     if (!BN_rand(n, 1024 /* bit length */, -1 /* no modification of top bits */,

  1302.                  0 /* don't modify bottom bit */) ||

  1303.         !BN_mul(nn, n, n, ctx) ||

  1304.         !BN_sqrt(sqrt, nn, ctx)) {

  1305.       BIO_print_errors_fp(stderr);

  1306.       return 0;

  1307.     }

  1308.     if (BN_cmp(n, sqrt) != 0) {

  1309.       fprintf(stderr, "Bad result from BN_sqrt.\n");

  1310.       return 0;

  1311.     }

  1312.   }

  1313. 

  1314.   /* Test some non-squares */

  1315.   for (i = 0; i < 100; i++) {

  1316.     if (!BN_rand(n, 1024 /* bit length */, -1 /* no modification of top bits */,

  1317.                  0 /* don't modify bottom bit */) ||

  1318.         !BN_mul(nn, n, n, ctx) ||

  1319.         !BN_add(nn, nn, BN_value_one())) {

  1320.       BIO_print_errors_fp(stderr);

  1321.       return 0;

  1322.     }

  1323. 

  1324.     if (BN_sqrt(sqrt, nn, ctx)) {

  1325.       char *nn_str = BN_bn2dec(nn);

  1326.       fprintf(stderr, "BIO_sqrt didn't fail on a non-square: %s\n", nn_str);

  1327.       OPENSSL_free(nn_str);

  1328.     }

  1329.   }

  1330. 

  1331.   BN_free(n);

  1332.   BN_free(sqrt);

  1333.   BN_free(nn);

  1334. 

  1335.   return 1;

  1336. }

  1337. 

  1338. int test_bn2bin_padded(BIO *bp, BN_CTX *ctx) {

  1339.   BIGNUM *n = BN_new();

  1340.   uint8_t zeros[256], out[256], reference[128];

  1341.   size_t bytes;

  1342. 

  1343.   memset(zeros, 0, sizeof(zeros));

  1344. 

  1345.   /* Test edge case at 0. */

  1346.   if (!BN_bn2bin_padded(NULL, 0, n)) {

  1347.     fprintf(stderr,

  1348.             "BN_bn2bin_padded failed to encode 0 in an empty buffer.\n");

  1349.     return 0;

  1350.   }

  1351.   memset(out, -1, sizeof(out));

  1352.   if (!BN_bn2bin_padded(out, sizeof(out), n)) {

  1353.     fprintf(stderr,

  1354.             "BN_bn2bin_padded failed to encode 0 in a non-empty buffer.\n");

  1355.     return 0;

  1356.   }

  1357.   if (memcmp(zeros, out, sizeof(out))) {

  1358.     fprintf(stderr, "BN_bn2bin_padded did not zero buffer.\n");

  1359.     return 0;

  1360.   }

  1361. 

  1362.   /* Test a random numbers at various byte lengths. */

  1363.   for (bytes = 128 - 7; bytes <= 128; bytes++) {

  1364.     if (!BN_rand(n, bytes * 8, 0 /* make sure top bit is 1 */,

  1365.                  0 /* don't modify bottom bit */)) {

  1366.       BIO_print_errors_fp(stderr);

  1367.       return 0;

  1368.     }

  1369.     if (BN_num_bytes(n) != bytes || BN_bn2bin(n, reference) != bytes) {

  1370.       fprintf(stderr, "Bad result from BN_rand; bytes.\n");

  1371.       return 0;

  1372.     }

  1373.     /* Empty buffer should fail. */

  1374.     if (BN_bn2bin_padded(NULL, 0, n)) {

  1375.       fprintf(stderr,

  1376.               "BN_bn2bin_padded incorrectly succeeded on empty buffer.\n");

  1377.       return 0;

  1378.     }

  1379.     /* One byte short should fail. */

  1380.     if (BN_bn2bin_padded(out, bytes - 1, n)) {

  1381.       fprintf(stderr, "BN_bn2bin_padded incorrectly succeeded on short.\n");

  1382.       return 0;

  1383.     }

  1384.     /* Exactly right size should encode. */

  1385.     if (!BN_bn2bin_padded(out, bytes, n) ||

  1386.         memcmp(out, reference, bytes) != 0) {

  1387.       fprintf(stderr, "BN_bn2bin_padded gave a bad result.\n");

  1388.       return 0;

  1389.     }

  1390.     /* Pad up one byte extra. */

  1391.     if (!BN_bn2bin_padded(out, bytes + 1, n) ||

  1392.         memcmp(out + 1, reference, bytes) || memcmp(out, zeros, 1)) {

  1393.       fprintf(stderr, "BN_bn2bin_padded gave a bad result.\n");

  1394.       return 0;

  1395.     }

  1396.     /* Pad up to 256. */

  1397.     if (!BN_bn2bin_padded(out, sizeof(out), n) ||

  1398.         memcmp(out + sizeof(out) - bytes, reference, bytes) ||

  1399.         memcmp(out, zeros, sizeof(out) - bytes)) {

  1400.       fprintf(stderr, "BN_bn2bin_padded gave a bad result.\n");

  1401.       return 0;

  1402.     }

  1403.   }

  1404. 

  1405.   BN_free(n);

  1406. 

  1407.   return 1;

  1408. }