kris
/
boringssl
1
0
Rozštěpit 0
Zdrojový kód Úkoly 0 Požadavky na natažení 0 Vydání 0 Wiki Aktivita
Nelze vybrat více než 25 témat Téma musí začínat písmenem nebo číslem, může obsahovat pomlčky („-“) a může být dlouhé až 35 znaků.
1641 Revize
12 Větve
38 MiB
 
 
 
 
 
 
Strom: 6de0e53919
Větve Značky
${ item.name }
Vytvořit větev ${ searchTerm }
z „6de0e53919“
${ noResults }
boringssl/crypto/bn/bn_test.cc

1719 řádky
47 KiB
Surový Blame Historie 

  1. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

  2.  * All rights reserved.

  3.  *

  4.  * This package is an SSL implementation written

  5.  * by Eric Young (eay@cryptsoft.com).

  6.  * The implementation was written so as to conform with Netscapes SSL.

  7.  *

  8.  * This library is free for commercial and non-commercial use as long as

  9.  * the following conditions are aheared to.  The following conditions

  10.  * apply to all code found in this distribution, be it the RC4, RSA,

  11.  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

  12.  * included with this distribution is covered by the same copyright terms

  13.  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

  14.  *

  15.  * Copyright remains Eric Young's, and as such any Copyright notices in

  16.  * the code are not to be removed.

  17.  * If this package is used in a product, Eric Young should be given attribution

  18.  * as the author of the parts of the library used.

  19.  * This can be in the form of a textual message at program startup or

  20.  * in documentation (online or textual) provided with the package.

  21.  *

  22.  * Redistribution and use in source and binary forms, with or without

  23.  * modification, are permitted provided that the following conditions

  24.  * are met:

  25.  * 1. Redistributions of source code must retain the copyright

  26.  *    notice, this list of conditions and the following disclaimer.

  27.  * 2. Redistributions in binary form must reproduce the above copyright

  28.  *    notice, this list of conditions and the following disclaimer in the

  29.  *    documentation and/or other materials provided with the distribution.

  30.  * 3. All advertising materials mentioning features or use of this software

  31.  *    must display the following acknowledgement:

  32.  *    "This product includes cryptographic software written by

  33.  *     Eric Young (eay@cryptsoft.com)"

  34.  *    The word 'cryptographic' can be left out if the rouines from the library

  35.  *    being used are not cryptographic related :-).

  36.  * 4. If you include any Windows specific code (or a derivative thereof) from

  37.  *    the apps directory (application code) you must include an acknowledgement:

  38.  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

  39.  *

  40.  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

  41.  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

  42.  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

  43.  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

  44.  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

  45.  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

  46.  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

  47.  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

  48.  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

  49.  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

  50.  * SUCH DAMAGE.

  51.  *

  52.  * The licence and distribution terms for any publically available version or

  53.  * derivative of this code cannot be changed.  i.e. this code cannot simply be

  54.  * copied and put under another distribution licence

  55.  * [including the GNU Public Licence.]

  56.  */

  57. /* ====================================================================

  58.  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.

  59.  *

  60.  * Portions of the attached software ("Contribution") are developed by

  61.  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.

  62.  *

  63.  * The Contribution is licensed pursuant to the Eric Young open source

  64.  * license provided above.

  65.  *

  66.  * The binary polynomial arithmetic software is originally written by

  67.  * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems

  68.  * Laboratories. */

  69. 

  70. /* For BIGNUM format macros. */

  71. #if !defined(__STDC_FORMAT_MACROS)

  72. #define __STDC_FORMAT_MACROS

  73. #endif

  74. 

  75. #include <errno.h>

  76. #include <stdio.h>

  77. #include <string.h>

  78. 

  79. #include <openssl/bn.h>

  80. #include <openssl/crypto.h>

  81. #include <openssl/err.h>

  82. #include <openssl/mem.h>

  83. 

  84. #include "../crypto/test/scoped_types.h"

  85. 

  86. 

  87. // This program tests the BIGNUM implementation. It takes an optional -bc

  88. // argument to write a transcript compatible with the UNIX bc utility.

  89. //

  90. // TODO(davidben): Rather than generate random inputs and depend on bc to check

  91. // the results, most of these tests should use known answers.

  92. 

  93. static const int num0 = 100; // number of tests

  94. static const int num1 = 50;  // additional tests for some functions

  95. static const int num2 = 5;   // number of tests for slow functions

  96. 

  97. static bool test_add(FILE *fp);

  98. static bool test_sub(FILE *fp);

  99. static bool test_lshift1(FILE *fp);

  100. static bool test_lshift(FILE *fp, BN_CTX *ctx, ScopedBIGNUM a);

  101. static bool test_rshift1(FILE *fp);

  102. static bool test_rshift(FILE *fp, BN_CTX *ctx);

  103. static bool test_sqr(FILE *fp, BN_CTX *ctx);

  104. static bool test_mul(FILE *fp);

  105. static bool test_div(FILE *fp, BN_CTX *ctx);

  106. static int rand_neg();

  107. 

  108. static bool test_div_word(FILE *fp);

  109. static bool test_mont(FILE *fp, BN_CTX *ctx);

  110. static bool test_mod(FILE *fp, BN_CTX *ctx);

  111. static bool test_mod_mul(FILE *fp, BN_CTX *ctx);

  112. static bool test_mod_exp(FILE *fp, BN_CTX *ctx);

  113. static bool test_mod_exp_mont_consttime(FILE *fp, BN_CTX *ctx);

  114. static bool test_exp(FILE *fp, BN_CTX *ctx);

  115. static bool test_mod_sqrt(FILE *fp, BN_CTX *ctx);

  116. static bool test_exp_mod_zero(void);

  117. static bool test_small_prime(FILE *fp, BN_CTX *ctx);

  118. static bool test_mod_exp_mont5(FILE *fp, BN_CTX *ctx);

  119. static bool test_sqrt(FILE *fp, BN_CTX *ctx);

  120. static bool test_bn2bin_padded(BN_CTX *ctx);

  121. static bool test_dec2bn(BN_CTX *ctx);

  122. static bool test_hex2bn(BN_CTX *ctx);

  123. static bool test_asc2bn(BN_CTX *ctx);

  124. static bool test_rand();

  125. static bool test_asn1();

  126. 

  127. static const uint8_t kSample[] =

  128.     "\xC6\x4F\x43\x04\x2A\xEA\xCA\x6E\x58\x36\x80\x5B\xE8\xC9"

  129.     "\x9B\x04\x5D\x48\x36\xC2\xFD\x16\xC9\x64\xF0";

  130. 

  131. // A wrapper around puts that takes its arguments in the same order as our *_fp

  132. // functions.

  133. static void puts_fp(FILE *out, const char *m) {

  134.   if (out != nullptr) {

  135.     fputs(m, out);

  136.   }

  137. }

  138. 

  139. static void flush_fp(FILE *out) {

  140.   if (out != nullptr) {

  141.     fflush(out);

  142.   }

  143. }

  144. 

  145. static void message(FILE *out, const char *m) {

  146.   puts_fp(out, "print \"test ");

  147.   puts_fp(out, m);

  148.   puts_fp(out, "\\n\"\n");

  149. }

  150. 

  151. int main(int argc, char *argv[]) {

  152.   CRYPTO_library_init();

  153. 

  154.   ScopedFILE bc_file;

  155.   argc--;

  156.   argv++;

  157.   while (argc >= 1) {

  158.     if (strcmp(*argv, "-bc") == 0) {

  159.       if (argc < 2) {

  160.         fprintf(stderr, "Missing parameter to -bc\n");

  161.         return 1;

  162.       }

  163.       bc_file.reset(fopen(argv[1], "w+"));

  164.       if (!bc_file) {

  165.         fprintf(stderr, "Failed to open %s: %s\n", argv[1], strerror(errno));

  166.       }

  167.       argc--;

  168.       argv++;

  169.     } else {

  170.       fprintf(stderr, "Unknown option: %s\n", argv[0]);

  171.       return 1;

  172.     }

  173.     argc--;

  174.     argv++;

  175.   }

  176. 

  177. 

  178.   ScopedBN_CTX ctx(BN_CTX_new());

  179.   if (!ctx) {

  180.     return 1;

  181.   }

  182. 

  183.   puts_fp(bc_file.get(), "/* This script, when run through the UNIX bc utility, "

  184.                          "should produce a sequence of zeros. */\n");

  185.   puts_fp(bc_file.get(), "/* tr a-f A-F < bn_test.out | sed s/BAsE/base/ | bc "

  186.                          "| grep -v 0 */\n");

  187.   puts_fp(bc_file.get(), "obase=16\nibase=16\n");

  188. 

  189.   message(bc_file.get(), "BN_add");

  190.   if (!test_add(bc_file.get())) {

  191.     return 1;

  192.   }

  193.   flush_fp(bc_file.get());

  194. 

  195.   message(bc_file.get(), "BN_sub");

  196.   if (!test_sub(bc_file.get())) {

  197.     return 1;

  198.   }

  199.   flush_fp(bc_file.get());

  200. 

  201.   message(bc_file.get(), "BN_lshift1");

  202.   if (!test_lshift1(bc_file.get())) {

  203.     return 1;

  204.   }

  205.   flush_fp(bc_file.get());

  206. 

  207.   message(bc_file.get(), "BN_lshift (fixed)");

  208.   ScopedBIGNUM sample(BN_bin2bn(kSample, sizeof(kSample) - 1, NULL));

  209.   if (!sample) {

  210.     return 1;

  211.   }

  212.   if (!test_lshift(bc_file.get(), ctx.get(), bssl::move(sample))) {

  213.     return 1;

  214.   }

  215.   flush_fp(bc_file.get());

  216. 

  217.   message(bc_file.get(), "BN_lshift");

  218.   if (!test_lshift(bc_file.get(), ctx.get(), nullptr)) {

  219.     return 1;

  220.   }

  221.   flush_fp(bc_file.get());

  222. 

  223.   message(bc_file.get(), "BN_rshift1");

  224.   if (!test_rshift1(bc_file.get())) {

  225.     return 1;

  226.   }

  227.   flush_fp(bc_file.get());

  228. 

  229.   message(bc_file.get(), "BN_rshift");

  230.   if (!test_rshift(bc_file.get(), ctx.get())) {

  231.     return 1;

  232.   }

  233.   flush_fp(bc_file.get());

  234. 

  235.   message(bc_file.get(), "BN_sqr");

  236.   if (!test_sqr(bc_file.get(), ctx.get())) {

  237.     return 1;

  238.   }

  239.   flush_fp(bc_file.get());

  240. 

  241.   message(bc_file.get(), "BN_mul");

  242.   if (!test_mul(bc_file.get())) {

  243.     return 1;

  244.   }

  245.   flush_fp(bc_file.get());

  246. 

  247.   message(bc_file.get(), "BN_div");

  248.   if (!test_div(bc_file.get(), ctx.get())) {

  249.     return 1;

  250.   }

  251.   flush_fp(bc_file.get());

  252. 

  253.   message(bc_file.get(), "BN_div_word");

  254.   if (!test_div_word(bc_file.get())) {

  255.     return 1;

  256.   }

  257.   flush_fp(bc_file.get());

  258. 

  259.   message(bc_file.get(), "BN_mod");

  260.   if (!test_mod(bc_file.get(), ctx.get())) {

  261.     return 1;

  262.   }

  263.   flush_fp(bc_file.get());

  264. 

  265.   message(bc_file.get(), "BN_mod_mul");

  266.   if (!test_mod_mul(bc_file.get(), ctx.get())) {

  267.     return 1;

  268.   }

  269.   flush_fp(bc_file.get());

  270. 

  271.   message(bc_file.get(), "BN_mont");

  272.   if (!test_mont(bc_file.get(), ctx.get())) {

  273.     return 1;

  274.   }

  275.   flush_fp(bc_file.get());

  276. 

  277.   message(bc_file.get(), "BN_mod_exp");

  278.   if (!test_mod_exp(bc_file.get(), ctx.get())) {

  279.     return 1;

  280.   }

  281.   flush_fp(bc_file.get());

  282. 

  283.   message(bc_file.get(), "BN_mod_exp_mont_consttime");

  284.   if (!test_mod_exp_mont_consttime(bc_file.get(), ctx.get()) ||

  285.       !test_mod_exp_mont5(bc_file.get(), ctx.get())) {

  286.     return 1;

  287.   }

  288.   flush_fp(bc_file.get());

  289. 

  290.   message(bc_file.get(), "BN_exp");

  291.   if (!test_exp(bc_file.get(), ctx.get()) ||

  292.       !test_exp_mod_zero()) {

  293.     return 1;

  294.   }

  295.   flush_fp(bc_file.get());

  296. 

  297.   message(bc_file.get(), "BN_mod_sqrt");

  298.   if (!test_mod_sqrt(bc_file.get(), ctx.get())) {

  299.     return 1;

  300.   }

  301.   flush_fp(bc_file.get());

  302. 

  303.   message(bc_file.get(), "Small prime generation");

  304.   if (!test_small_prime(bc_file.get(), ctx.get())) {

  305.     return 1;

  306.   }

  307.   flush_fp(bc_file.get());

  308. 

  309.   message(bc_file.get(), "BN_sqrt");

  310.   if (!test_sqrt(bc_file.get(), ctx.get())) {

  311.     return 1;

  312.   }

  313.   flush_fp(bc_file.get());

  314. 

  315.   if (!test_bn2bin_padded(ctx.get()) ||

  316.       !test_dec2bn(ctx.get()) ||

  317.       !test_hex2bn(ctx.get()) ||

  318.       !test_asc2bn(ctx.get()) ||

  319.       !test_rand() ||

  320.       !test_asn1()) {

  321.     return 1;

  322.   }

  323. 

  324.   printf("PASS\n");

  325.   return 0;

  326. }

  327. 

  328. static bool test_add(FILE *fp) {

  329.   ScopedBIGNUM a(BN_new());

  330.   ScopedBIGNUM b(BN_new());

  331.   ScopedBIGNUM c(BN_new());

  332.   if (!a || !b || !c || !BN_rand(a.get(), 512, 0, 0)) {

  333.     return false;

  334.   }

  335. 

  336.   for (int i = 0; i < num0; i++) {

  337.     if (!BN_rand(b.get(), 450 + i, 0, 0)) {

  338.       return false;

  339.     }

  340.     a->neg = rand_neg();

  341.     b->neg = rand_neg();

  342.     if (!BN_add(c.get(), a.get(), b.get())) {

  343.       return false;

  344.     }

  345.     if (fp != NULL) {

  346.       BN_print_fp(fp, a.get());

  347.       puts_fp(fp, " + ");

  348.       BN_print_fp(fp, b.get());

  349.       puts_fp(fp, " - ");

  350.       BN_print_fp(fp, c.get());

  351.       puts_fp(fp, "\n");

  352.     }

  353.     a->neg = !a->neg;

  354.     b->neg = !b->neg;

  355.     if (!BN_add(c.get(), c.get(), b.get()) ||

  356.         !BN_add(c.get(), c.get(), a.get())) {

  357.       return false;

  358.     }

  359.     if (!BN_is_zero(c.get())) {

  360.       fprintf(stderr, "Add test failed!\n");

  361.       return false;

  362.     }

  363.   }

  364.   return true;

  365. }

  366. 

  367. static bool test_sub(FILE *fp) {

  368.   ScopedBIGNUM a(BN_new());

  369.   ScopedBIGNUM b(BN_new());

  370.   ScopedBIGNUM c(BN_new());

  371.   if (!a || !b || !c) {

  372.     return false;

  373.   }

  374. 

  375.   for (int i = 0; i < num0 + num1; i++) {

  376.     if (i < num1) {

  377.       if (!BN_rand(a.get(), 512, 0, 0) ||

  378.           !BN_copy(b.get(), a.get()) ||

  379.           !BN_set_bit(a.get(), i) ||

  380.           !BN_add_word(b.get(), i)) {

  381.         return false;

  382.       }

  383.     } else {

  384.       if (!BN_rand(b.get(), 400 + i - num1, 0, 0)) {

  385.         return false;

  386.       }

  387.       a->neg = rand_neg();

  388.       b->neg = rand_neg();

  389.     }

  390.     if (!BN_sub(c.get(), a.get(), b.get())) {

  391.       return false;

  392.     }

  393.     if (fp != NULL) {

  394.       BN_print_fp(fp, a.get());

  395.       puts_fp(fp, " - ");

  396.       BN_print_fp(fp, b.get());

  397.       puts_fp(fp, " - ");

  398.       BN_print_fp(fp, c.get());

  399.       puts_fp(fp, "\n");

  400.     }

  401.     if (!BN_add(c.get(), c.get(), b.get()) ||

  402.         !BN_sub(c.get(), c.get(), a.get())) {

  403.       return false;

  404.     }

  405.     if (!BN_is_zero(c.get())) {

  406.       fprintf(stderr, "Subtract test failed!\n");

  407.       return false;

  408.     }

  409.   }

  410.   return true;

  411. }

  412. 

  413. static bool test_div(FILE *fp, BN_CTX *ctx) {

  414.   ScopedBIGNUM a(BN_new());

  415.   ScopedBIGNUM b(BN_new());

  416.   ScopedBIGNUM c(BN_new());

  417.   ScopedBIGNUM d(BN_new());

  418.   ScopedBIGNUM e(BN_new());

  419.   if (!a || !b || !c || !d || !e) {

  420.     return false;

  421.   }

  422. 

  423.   for (int i = 0; i < num0 + num1; i++) {

  424.     if (i < num1) {

  425.       if (!BN_rand(a.get(), 400, 0, 0) ||

  426.           !BN_copy(b.get(), a.get()) ||

  427.           !BN_lshift(a.get(), a.get(), i) ||

  428.           !BN_add_word(a.get(), i)) {

  429.         return false;

  430.       }

  431.     } else if (!BN_rand(b.get(), 50 + 3 * (i - num1), 0, 0)) {

  432.       return false;

  433.     }

  434.     a->neg = rand_neg();

  435.     b->neg = rand_neg();

  436.     if (!BN_div(d.get(), c.get(), a.get(), b.get(), ctx)) {

  437.       return false;

  438.     }

  439.     if (fp != NULL) {

  440.       BN_print_fp(fp, a.get());

  441.       puts_fp(fp, " / ");

  442.       BN_print_fp(fp, b.get());

  443.       puts_fp(fp, " - ");

  444.       BN_print_fp(fp, d.get());

  445.       puts_fp(fp, "\n");

  446. 

  447.       BN_print_fp(fp, a.get());

  448.       puts_fp(fp, " % ");

  449.       BN_print_fp(fp, b.get());

  450.       puts_fp(fp, " - ");

  451.       BN_print_fp(fp, c.get());

  452.       puts_fp(fp, "\n");

  453.     }

  454.     if (!BN_mul(e.get(), d.get(), b.get(), ctx) ||

  455.         !BN_add(d.get(), e.get(), c.get()) ||

  456.         !BN_sub(d.get(), d.get(), a.get())) {

  457.       return false;

  458.     }

  459.     if (!BN_is_zero(d.get())) {

  460.       fprintf(stderr, "Division test failed!\n");

  461.       return false;

  462.     }

  463.   }

  464. 

  465.   // Test that BN_div never gives negative zero in the quotient.

  466.   if (!BN_set_word(a.get(), 1) ||

  467.       !BN_set_word(b.get(), 2)) {

  468.     return false;

  469.   }

  470.   BN_set_negative(a.get(), 1);

  471.   if (!BN_div(d.get(), c.get(), a.get(), b.get(), ctx)) {

  472.     return false;

  473.   }

  474.   if (!BN_is_zero(d.get()) || BN_is_negative(d.get())) {

  475.     fprintf(stderr, "Division test failed!\n");

  476.     return false;

  477.   }

  478. 

  479.   // Test that BN_div never gives negative zero in the remainder.

  480.   if (!BN_set_word(b.get(), 1)) {

  481.     return false;

  482.   }

  483.   if (!BN_div(d.get(), c.get(), a.get(), b.get(), ctx)) {

  484.     return false;

  485.   }

  486.   if (!BN_is_zero(c.get()) || BN_is_negative(c.get())) {

  487.     fprintf(stderr, "Division test failed!\n");

  488.     return false;

  489.   }

  490. 

  491.   return true;

  492. }

  493. 

  494. static bool test_lshift1(FILE *fp) {

  495.   ScopedBIGNUM a(BN_new());

  496.   ScopedBIGNUM b(BN_new());

  497.   ScopedBIGNUM c(BN_new());

  498.   if (!a || !b || !c || !BN_rand(a.get(), 200, 0, 0)) {

  499.     return false;

  500.   }

  501.   a->neg = rand_neg();

  502.   for (int i = 0; i < num0; i++) {

  503.     if (!BN_lshift1(b.get(), a.get())) {

  504.       return false;

  505.     }

  506.     if (fp != NULL) {

  507.       BN_print_fp(fp, a.get());

  508.       puts_fp(fp, " * 2");

  509.       puts_fp(fp, " - ");

  510.       BN_print_fp(fp, b.get());

  511.       puts_fp(fp, "\n");

  512.     }

  513.     if (!BN_add(c.get(), a.get(), a.get()) ||

  514.         !BN_sub(a.get(), b.get(), c.get())) {

  515.       return false;

  516.     }

  517.     if (!BN_is_zero(a.get())) {

  518.       fprintf(stderr, "Left shift one test failed!\n");

  519.       return false;

  520.     }

  521. 

  522.     if (!BN_copy(a.get(), b.get())) {

  523.       return false;

  524.     }

  525.   }

  526.   return true;

  527. }

  528. 

  529. static bool test_rshift(FILE *fp, BN_CTX *ctx) {

  530.   ScopedBIGNUM a(BN_new());

  531.   ScopedBIGNUM b(BN_new());

  532.   ScopedBIGNUM c(BN_new());

  533.   ScopedBIGNUM d(BN_new());

  534.   ScopedBIGNUM e(BN_new());

  535.   if (!a || !b || !c || !d || !e || !BN_one(c.get()) ||

  536.       !BN_rand(a.get(), 200, 0, 0)) {

  537.     return false;

  538.   }

  539.   a->neg = rand_neg();

  540.   for (int i = 0; i < num0; i++) {

  541.     if (!BN_rshift(b.get(), a.get(), i + 1) ||

  542.         !BN_add(c.get(), c.get(), c.get())) {

  543.       return false;

  544.     }

  545.     if (fp != NULL) {

  546.       BN_print_fp(fp, a.get());

  547.       puts_fp(fp, " / ");

  548.       BN_print_fp(fp, c.get());

  549.       puts_fp(fp, " - ");

  550.       BN_print_fp(fp, b.get());

  551.       puts_fp(fp, "\n");

  552.     }

  553.     if (!BN_div(d.get(), e.get(), a.get(), c.get(), ctx) ||

  554.         !BN_sub(d.get(), d.get(), b.get())) {

  555.       return false;

  556.     }

  557.     if (!BN_is_zero(d.get())) {

  558.       fprintf(stderr, "Right shift test failed!\n");

  559.       return false;

  560.     }

  561.   }

  562.   return true;

  563. }

  564. 

  565. static bool test_rshift1(FILE *fp) {

  566.   ScopedBIGNUM a(BN_new());

  567.   ScopedBIGNUM b(BN_new());

  568.   ScopedBIGNUM c(BN_new());

  569.   if (!a || !b || !c || !BN_rand(a.get(), 200, 0, 0)) {

  570.     return false;

  571.   }

  572.   a->neg = rand_neg();

  573. 

  574.   for (int i = 0; i < num0; i++) {

  575.     if (!BN_rshift1(b.get(), a.get())) {

  576.       return false;

  577.     }

  578.     if (fp != NULL) {

  579.       BN_print_fp(fp, a.get());

  580.       puts_fp(fp, " / 2");

  581.       puts_fp(fp, " - ");

  582.       BN_print_fp(fp, b.get());

  583.       puts_fp(fp, "\n");

  584.     }

  585.     if (!BN_sub(c.get(), a.get(), b.get()) ||

  586.         !BN_sub(c.get(), c.get(), b.get())) {

  587.       return false;

  588.     }

  589.     if (!BN_is_zero(c.get()) && !BN_abs_is_word(c.get(), 1)) {

  590.       fprintf(stderr, "Right shift one test failed!\n");

  591.       return false;

  592.     }

  593.     if (!BN_copy(a.get(), b.get())) {

  594.       return false;

  595.     }

  596.   }

  597.   return true;

  598. }

  599. 

  600. static bool test_lshift(FILE *fp, BN_CTX *ctx, ScopedBIGNUM a) {

  601.   if (!a) {

  602.     a.reset(BN_new());

  603.     if (!a || !BN_rand(a.get(), 200, 0, 0)) {

  604.       return false;

  605.     }

  606.     a->neg = rand_neg();

  607.   }

  608. 

  609.   ScopedBIGNUM b(BN_new());

  610.   ScopedBIGNUM c(BN_new());

  611.   ScopedBIGNUM d(BN_new());

  612.   if (!b || !c || !d || !BN_one(c.get())) {

  613.     return false;

  614.   }

  615. 

  616.   for (int i = 0; i < num0; i++) {

  617.     if (!BN_lshift(b.get(), a.get(), i + 1) ||

  618.         !BN_add(c.get(), c.get(), c.get())) {

  619.       return false;

  620.     }

  621.     if (fp != NULL) {

  622.       BN_print_fp(fp, a.get());

  623.       puts_fp(fp, " * ");

  624.       BN_print_fp(fp, c.get());

  625.       puts_fp(fp, " - ");

  626.       BN_print_fp(fp, b.get());

  627.       puts_fp(fp, "\n");

  628.     }

  629.     if (!BN_mul(d.get(), a.get(), c.get(), ctx) ||

  630.         !BN_sub(d.get(), d.get(), b.get())) {

  631.       return false;

  632.     }

  633.     if (!BN_is_zero(d.get())) {

  634.       fprintf(stderr, "Left shift test failed!\n");

  635.       fprintf(stderr, "a=");

  636.       BN_print_fp(stderr, a.get());

  637.       fprintf(stderr, "\nb=");

  638.       BN_print_fp(stderr, b.get());

  639.       fprintf(stderr, "\nc=");

  640.       BN_print_fp(stderr, c.get());

  641.       fprintf(stderr, "\nd=");

  642.       BN_print_fp(stderr, d.get());

  643.       fprintf(stderr, "\n");

  644.       return false;

  645.     }

  646.   }

  647.   return true;

  648. }

  649. 

  650. static bool test_mul(FILE *fp) {

  651.   ScopedBN_CTX ctx(BN_CTX_new());

  652.   ScopedBIGNUM a(BN_new());

  653.   ScopedBIGNUM b(BN_new());

  654.   ScopedBIGNUM c(BN_new());

  655.   ScopedBIGNUM d(BN_new());

  656.   ScopedBIGNUM e(BN_new());

  657.   if (!ctx || !a || !b || !c || !d || !e) {

  658.     return false;

  659.   }

  660. 

  661.   for (int i = 0; i < num0 + num1; i++) {

  662.     if (i <= num1) {

  663.       if (!BN_rand(a.get(), 100, 0, 0) ||

  664.           !BN_rand(b.get(), 100, 0, 0)) {

  665.         return false;

  666.       }

  667.     } else if (!BN_rand(b.get(), i - num1, 0, 0)) {

  668.       return false;

  669.     }

  670.     a->neg = rand_neg();

  671.     b->neg = rand_neg();

  672.     if (!BN_mul(c.get(), a.get(), b.get(), ctx.get())) {

  673.       return false;

  674.     }

  675.     if (fp != NULL) {

  676.       BN_print_fp(fp, a.get());

  677.       puts_fp(fp, " * ");

  678.       BN_print_fp(fp, b.get());

  679.       puts_fp(fp, " - ");

  680.       BN_print_fp(fp, c.get());

  681.       puts_fp(fp, "\n");

  682.     }

  683.     if (!BN_div(d.get(), e.get(), c.get(), a.get(), ctx.get()) ||

  684.         !BN_sub(d.get(), d.get(), b.get())) {

  685.       return false;

  686.     }

  687.     if (!BN_is_zero(d.get()) || !BN_is_zero(e.get())) {

  688.       fprintf(stderr, "Multiplication test failed!\n");

  689.       return false;

  690.     }

  691.   }

  692. 

  693.   // Test that BN_mul never gives negative zero.

  694.   if (!BN_set_word(a.get(), 1)) {

  695.     return false;

  696.   }

  697.   BN_set_negative(a.get(), 1);

  698.   BN_zero(b.get());

  699.   if (!BN_mul(c.get(), a.get(), b.get(), ctx.get())) {

  700.     return false;

  701.   }

  702.   if (!BN_is_zero(c.get()) || BN_is_negative(c.get())) {

  703.     fprintf(stderr, "Multiplication test failed!\n");

  704.     return false;

  705.   }

  706. 

  707.   return true;

  708. }

  709. 

  710. static bool test_sqr(FILE *fp, BN_CTX *ctx) {

  711.   ScopedBIGNUM a(BN_new());

  712.   ScopedBIGNUM c(BN_new());

  713.   ScopedBIGNUM d(BN_new());

  714.   ScopedBIGNUM e(BN_new());

  715.   if (!a || !c || !d || !e) {

  716.     return false;

  717.   }

  718. 

  719.   for (int i = 0; i < num0; i++) {

  720.     if (!BN_rand(a.get(), 40 + i * 10, 0, 0)) {

  721.       return false;

  722.     }

  723.     a->neg = rand_neg();

  724.     if (!BN_sqr(c.get(), a.get(), ctx)) {

  725.       return false;

  726.     }

  727.     if (fp != NULL) {

  728.       BN_print_fp(fp, a.get());

  729.       puts_fp(fp, " * ");

  730.       BN_print_fp(fp, a.get());

  731.       puts_fp(fp, " - ");

  732.       BN_print_fp(fp, c.get());

  733.       puts_fp(fp, "\n");

  734.     }

  735.     if (!BN_div(d.get(), e.get(), c.get(), a.get(), ctx) ||

  736.         !BN_sub(d.get(), d.get(), a.get())) {

  737.       return false;

  738.     }

  739.     if (!BN_is_zero(d.get()) || !BN_is_zero(e.get())) {

  740.       fprintf(stderr, "Square test failed!\n");

  741.       return false;

  742.     }

  743.   }

  744. 

  745.   // Regression test for a BN_sqr overflow bug.

  746.   BIGNUM *a_raw = a.get();

  747.   if (!BN_hex2bn(

  748.           &a_raw,

  749.           "80000000000000008000000000000001FFFFFFFFFFFFFFFE0000000000000000") ||

  750.       !BN_sqr(c.get(), a.get(), ctx)) {

  751.     return false;

  752.   }

  753.   if (fp != NULL) {

  754.     BN_print_fp(fp, a.get());

  755.     puts_fp(fp, " * ");

  756.     BN_print_fp(fp, a.get());

  757.     puts_fp(fp, " - ");

  758.     BN_print_fp(fp, c.get());

  759.     puts_fp(fp, "\n");

  760.   }

  761.   if (!BN_mul(d.get(), a.get(), a.get(), ctx)) {

  762.     return false;

  763.   }

  764.   if (BN_cmp(c.get(), d.get())) {

  765.     fprintf(stderr,

  766.             "Square test failed: BN_sqr and BN_mul produce "

  767.             "different results!\n");

  768.     return false;

  769.   }

  770. 

  771.   // Regression test for a BN_sqr overflow bug.

  772.   a_raw = a.get();

  773.   if (!BN_hex2bn(

  774.           &a_raw,

  775.           "80000000000000000000000080000001FFFFFFFE000000000000000000000000") ||

  776.       !BN_sqr(c.get(), a.get(), ctx)) {

  777.     return false;

  778.   }

  779.   if (fp != NULL) {

  780.     BN_print_fp(fp, a.get());

  781.     puts_fp(fp, " * ");

  782.     BN_print_fp(fp, a.get());

  783.     puts_fp(fp, " - ");

  784.     BN_print_fp(fp, c.get());

  785.     puts_fp(fp, "\n");

  786.   }

  787.   if (!BN_mul(d.get(), a.get(), a.get(), ctx)) {

  788.     return false;

  789.   }

  790.   if (BN_cmp(c.get(), d.get())) {

  791.     fprintf(stderr,

  792.             "Square test failed: BN_sqr and BN_mul produce "

  793.             "different results!\n");

  794.     return false;

  795.   }

  796. 

  797.   return true;

  798. }

  799. 

  800. 

  801. static int rand_neg() {

  802.   static unsigned int neg = 0;

  803.   static const int sign[8] = {0, 0, 0, 1, 1, 0, 1, 1};

  804. 

  805.   return sign[(neg++) % 8];

  806. }

  807. 

  808. static void print_word(FILE *fp, BN_ULONG w) {

  809.   fprintf(fp, BN_HEX_FMT1, w);

  810. }

  811. 

  812. static bool test_div_word(FILE *fp) {

  813.   ScopedBIGNUM a(BN_new());

  814.   ScopedBIGNUM b(BN_new());

  815.   if (!a || !b) {

  816.     return false;

  817.   }

  818. 

  819.   for (int i = 0; i < num0; i++) {

  820.     BN_ULONG s;

  821.     do {

  822.       if (!BN_rand(a.get(), 512, -1, 0) ||

  823.           !BN_rand(b.get(), BN_BITS2, -1, 0)) {

  824.         return false;

  825.       }

  826.       s = b->d[0];

  827.     } while (!s);

  828. 

  829.     if (!BN_copy(b.get(), a.get())) {

  830.       return false;

  831.     }

  832.     BN_ULONG r = BN_div_word(b.get(), s);

  833.     if (r == (BN_ULONG)-1) {

  834.       return false;

  835.     }

  836. 

  837.     if (fp != NULL) {

  838.       BN_print_fp(fp, a.get());

  839.       puts_fp(fp, " / ");

  840.       print_word(fp, s);

  841.       puts_fp(fp, " - ");

  842.       BN_print_fp(fp, b.get());

  843.       puts_fp(fp, "\n");

  844. 

  845.       BN_print_fp(fp, a.get());

  846.       puts_fp(fp, " % ");

  847.       print_word(fp, s);

  848.       puts_fp(fp, " - ");

  849.       print_word(fp, r);

  850.       puts_fp(fp, "\n");

  851.     }

  852.     if (!BN_mul_word(b.get(), s) ||

  853.         !BN_add_word(b.get(), r) ||

  854.         !BN_sub(b.get(), a.get(), b.get())) {

  855.       return false;

  856.     }

  857.     if (!BN_is_zero(b.get())) {

  858.       fprintf(stderr, "Division (word) test failed!\n");

  859.       return false;

  860.     }

  861.   }

  862.   return true;

  863. }

  864. 

  865. static bool test_mont(FILE *fp, BN_CTX *ctx) {

  866.   ScopedBIGNUM a(BN_new());

  867.   ScopedBIGNUM b(BN_new());

  868.   ScopedBIGNUM c(BN_new());

  869.   ScopedBIGNUM d(BN_new());

  870.   ScopedBIGNUM A(BN_new());

  871.   ScopedBIGNUM B(BN_new());

  872.   ScopedBIGNUM n(BN_new());

  873.   ScopedBN_MONT_CTX mont(BN_MONT_CTX_new());

  874.   if (!a || !b || !c || !d || !A || !B || !n || !mont ||

  875.       !BN_rand(a.get(), 100, 0, 0) ||

  876.       !BN_rand(b.get(), 100, 0, 0)) {

  877.     return false;

  878.   }

  879. 

  880.   for (int i = 0; i < num2; i++) {

  881.     int bits = (200 * (i + 1)) / num2;

  882. 

  883.     if (bits == 0) {

  884.       continue;

  885.     }

  886.     if (!BN_rand(n.get(), bits, 0, 1) ||

  887.         !BN_MONT_CTX_set(mont.get(), n.get(), ctx) ||

  888.         !BN_nnmod(a.get(), a.get(), n.get(), ctx) ||

  889.         !BN_nnmod(b.get(), b.get(), n.get(), ctx) ||

  890.         !BN_to_montgomery(A.get(), a.get(), mont.get(), ctx) ||

  891.         !BN_to_montgomery(B.get(), b.get(), mont.get(), ctx) ||

  892.         !BN_mod_mul_montgomery(c.get(), A.get(), B.get(), mont.get(), ctx) ||

  893.         !BN_from_montgomery(A.get(), c.get(), mont.get(), ctx)) {

  894.       return false;

  895.     }

  896.     if (fp != NULL) {

  897.       BN_print_fp(fp, a.get());

  898.       puts_fp(fp, " * ");

  899.       BN_print_fp(fp, b.get());

  900.       puts_fp(fp, " % ");

  901.       BN_print_fp(fp, &mont->N);

  902.       puts_fp(fp, " - ");

  903.       BN_print_fp(fp, A.get());

  904.       puts_fp(fp, "\n");

  905.     }

  906.     if (!BN_mod_mul(d.get(), a.get(), b.get(), n.get(), ctx) ||

  907.         !BN_sub(d.get(), d.get(), A.get())) {

  908.       return false;

  909.     }

  910.     if (!BN_is_zero(d.get())) {

  911.       fprintf(stderr, "Montgomery multiplication test failed!\n");

  912.       return false;

  913.     }

  914.   }

  915.   return true;

  916. }

  917. 

  918. static bool test_mod(FILE *fp, BN_CTX *ctx) {

  919.   ScopedBIGNUM a(BN_new());

  920.   ScopedBIGNUM b(BN_new());

  921.   ScopedBIGNUM c(BN_new());

  922.   ScopedBIGNUM d(BN_new());

  923.   ScopedBIGNUM e(BN_new());

  924.   if (!a || !b || !c || !d || !e ||

  925.       !BN_rand(a.get(), 1024, 0, 0)) {

  926.     return false;

  927.   }

  928. 

  929.   for (int i = 0; i < num0; i++) {

  930.     if (!BN_rand(b.get(), 450 + i * 10, 0, 0)) {

  931.       return false;

  932.     }

  933.     a->neg = rand_neg();

  934.     b->neg = rand_neg();

  935.     if (!BN_mod(c.get(), a.get(), b.get(), ctx)) {

  936.       return false;

  937.     }

  938.     if (fp != NULL) {

  939.       BN_print_fp(fp, a.get());

  940.       puts_fp(fp, " % ");

  941.       BN_print_fp(fp, b.get());

  942.       puts_fp(fp, " - ");

  943.       BN_print_fp(fp, c.get());

  944.       puts_fp(fp, "\n");

  945.     }

  946.     if (!BN_div(d.get(), e.get(), a.get(), b.get(), ctx) ||

  947.         !BN_sub(e.get(), e.get(), c.get())) {

  948.       return false;

  949.     }

  950.     if (!BN_is_zero(e.get())) {

  951.       fprintf(stderr, "Modulo test failed!\n");

  952.       return false;

  953.     }

  954.   }

  955.   return true;

  956. }

  957. 

  958. static bool test_mod_mul(FILE *fp, BN_CTX *ctx) {

  959.   ScopedBIGNUM a(BN_new());

  960.   ScopedBIGNUM b(BN_new());

  961.   ScopedBIGNUM c(BN_new());

  962.   ScopedBIGNUM d(BN_new());

  963.   ScopedBIGNUM e(BN_new());

  964.   if (!a || !b || !c || !d || !e) {

  965.     return false;

  966.   }

  967. 

  968.   for (int j = 0; j < 3; j++) {

  969.     if (!BN_rand(c.get(), 1024, 0, 0)) {

  970.       return false;

  971.     }

  972.     for (int i = 0; i < num0; i++) {

  973.       if (!BN_rand(a.get(), 475 + i * 10, 0, 0) ||

  974.           !BN_rand(b.get(), 425 + i * 11, 0, 0)) {

  975.         return false;

  976.       }

  977.       a->neg = rand_neg();

  978.       b->neg = rand_neg();

  979.       if (!BN_mod_mul(e.get(), a.get(), b.get(), c.get(), ctx)) {

  980.         ERR_print_errors_fp(stderr);

  981.         return false;

  982.       }

  983.       if (fp != NULL) {

  984.         BN_print_fp(fp, a.get());

  985.         puts_fp(fp, " * ");

  986.         BN_print_fp(fp, b.get());

  987.         puts_fp(fp, " % ");

  988.         BN_print_fp(fp, c.get());

  989.         if (a->neg != b->neg && !BN_is_zero(e.get())) {

  990.           // If  (a*b) % c  is negative,  c  must be added

  991.           // in order to obtain the normalized remainder

  992.           // (new with OpenSSL 0.9.7, previous versions of

  993.           // BN_mod_mul could generate negative results)

  994.           puts_fp(fp, " + ");

  995.           BN_print_fp(fp, c.get());

  996.         }

  997.         puts_fp(fp, " - ");

  998.         BN_print_fp(fp, e.get());

  999.         puts_fp(fp, "\n");

  1000.       }

  1001.       if (!BN_mul(d.get(), a.get(), b.get(), ctx) ||

  1002.           !BN_sub(d.get(), d.get(), e.get()) ||

  1003.           !BN_div(a.get(), b.get(), d.get(), c.get(), ctx)) {

  1004.         return false;

  1005.       }

  1006.       if (!BN_is_zero(b.get())) {

  1007.         fprintf(stderr, "Modulo multiply test failed!\n");

  1008.         ERR_print_errors_fp(stderr);

  1009.         return false;

  1010.       }

  1011.     }

  1012.   }

  1013.   return true;

  1014. }

  1015. 

  1016. static bool test_mod_exp(FILE *fp, BN_CTX *ctx) {

  1017.   ScopedBIGNUM a(BN_new());

  1018.   ScopedBIGNUM b(BN_new());

  1019.   ScopedBIGNUM c(BN_new());

  1020.   ScopedBIGNUM d(BN_new());

  1021.   ScopedBIGNUM e(BN_new());

  1022.   if (!a || !b || !c || !d || !e ||

  1023.       !BN_rand(c.get(), 30, 0, 1)) {  // must be odd for montgomery

  1024.     return false;

  1025.   }

  1026.   for (int i = 0; i < num2; i++) {

  1027.     if (!BN_rand(a.get(), 20 + i * 5, 0, 0) ||

  1028.         !BN_rand(b.get(), 2 + i, 0, 0) ||

  1029.         !BN_mod_exp(d.get(), a.get(), b.get(), c.get(), ctx)) {

  1030.       return false;

  1031.     }

  1032. 

  1033.     if (fp != NULL) {

  1034.       BN_print_fp(fp, a.get());

  1035.       puts_fp(fp, " ^ ");

  1036.       BN_print_fp(fp, b.get());

  1037.       puts_fp(fp, " % ");

  1038.       BN_print_fp(fp, c.get());

  1039.       puts_fp(fp, " - ");

  1040.       BN_print_fp(fp, d.get());

  1041.       puts_fp(fp, "\n");

  1042.     }

  1043.     if (!BN_exp(e.get(), a.get(), b.get(), ctx) ||

  1044.         !BN_sub(e.get(), e.get(), d.get()) ||

  1045.         !BN_div(a.get(), b.get(), e.get(), c.get(), ctx)) {

  1046.       return false;

  1047.     }

  1048.     if (!BN_is_zero(b.get())) {

  1049.       fprintf(stderr, "Modulo exponentiation test failed!\n");

  1050.       return false;

  1051.     }

  1052.   }

  1053.   return true;

  1054. }

  1055. 

  1056. static bool test_mod_exp_mont_consttime(FILE *fp, BN_CTX *ctx) {

  1057.   ScopedBIGNUM a(BN_new());

  1058.   ScopedBIGNUM b(BN_new());

  1059.   ScopedBIGNUM c(BN_new());

  1060.   ScopedBIGNUM d(BN_new());

  1061.   ScopedBIGNUM e(BN_new());

  1062.   if (!a || !b || !c || !d || !e ||

  1063.       !BN_rand(c.get(), 30, 0, 1)) {  // must be odd for montgomery

  1064.     return false;

  1065.   }

  1066.   for (int i = 0; i < num2; i++) {

  1067.     if (!BN_rand(a.get(), 20 + i * 5, 0, 0) ||

  1068.         !BN_rand(b.get(), 2 + i, 0, 0) ||

  1069.         !BN_mod_exp_mont_consttime(d.get(), a.get(), b.get(), c.get(), ctx,

  1070.                                    NULL)) {

  1071.       return false;

  1072.     }

  1073. 

  1074.     if (fp != NULL) {

  1075.       BN_print_fp(fp, a.get());

  1076.       puts_fp(fp, " ^ ");

  1077.       BN_print_fp(fp, b.get());

  1078.       puts_fp(fp, " % ");

  1079.       BN_print_fp(fp, c.get());

  1080.       puts_fp(fp, " - ");

  1081.       BN_print_fp(fp, d.get());

  1082.       puts_fp(fp, "\n");

  1083.     }

  1084.     if (!BN_exp(e.get(), a.get(), b.get(), ctx) ||

  1085.         !BN_sub(e.get(), e.get(), d.get()) ||

  1086.         !BN_div(a.get(), b.get(), e.get(), c.get(), ctx)) {

  1087.       return false;

  1088.     }

  1089.     if (!BN_is_zero(b.get())) {

  1090.       fprintf(stderr, "Modulo exponentiation test failed!\n");

  1091.       return false;

  1092.     }

  1093.   }

  1094.   return true;

  1095. }

  1096. 

  1097. // Test constant-time modular exponentiation with 1024-bit inputs,

  1098. // which on x86_64 cause a different code branch to be taken.

  1099. static bool test_mod_exp_mont5(FILE *fp, BN_CTX *ctx) {

  1100.   ScopedBIGNUM a(BN_new());

  1101.   ScopedBIGNUM p(BN_new());

  1102.   ScopedBIGNUM m(BN_new());

  1103.   ScopedBIGNUM d(BN_new());

  1104.   ScopedBIGNUM e(BN_new());

  1105.   if (!a || !p || !m || !d || !e ||

  1106.       !BN_rand(m.get(), 1024, 0, 1) ||  // must be odd for montgomery

  1107.       !BN_rand(a.get(), 1024, 0, 0)) {

  1108.     return false;

  1109.   }

  1110.   // Zero exponent.

  1111.   BN_zero(p.get());

  1112.   if (!BN_mod_exp_mont_consttime(d.get(), a.get(), p.get(), m.get(), ctx,

  1113.                                  NULL)) {

  1114.     return false;

  1115.   }

  1116.   if (!BN_is_one(d.get())) {

  1117.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1118.     return false;

  1119.   }

  1120.   if (!BN_rand(p.get(), 1024, 0, 0)) {

  1121.     return false;

  1122.   }

  1123.   // Zero input.

  1124.   BN_zero(a.get());

  1125.   if (!BN_mod_exp_mont_consttime(d.get(), a.get(), p.get(), m.get(), ctx,

  1126.                                  NULL)) {

  1127.     return false;

  1128.   }

  1129.   if (!BN_is_zero(d.get())) {

  1130.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1131.     return false;

  1132.   }

  1133.   // Craft an input whose Montgomery representation is 1, i.e., shorter than the

  1134.   // modulus m, in order to test the const time precomputation

  1135.   // scattering/gathering.

  1136.   ScopedBN_MONT_CTX mont(BN_MONT_CTX_new());

  1137.   if (!mont || !BN_one(a.get()) ||

  1138.       !BN_MONT_CTX_set(mont.get(), m.get(), ctx) ||

  1139.       !BN_from_montgomery(e.get(), a.get(), mont.get(), ctx) ||

  1140.       !BN_mod_exp_mont_consttime(d.get(), e.get(), p.get(), m.get(), ctx,

  1141.                                  NULL) ||

  1142.       !BN_mod_exp(a.get(), e.get(), p.get(), m.get(), ctx)) {

  1143.     return false;

  1144.   }

  1145.   if (BN_cmp(a.get(), d.get()) != 0) {

  1146.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1147.     return false;

  1148.   }

  1149.   // Finally, some regular test vectors.

  1150.   if (!BN_rand(e.get(), 1024, 0, 0) ||

  1151.       !BN_mod_exp_mont_consttime(d.get(), e.get(), p.get(), m.get(), ctx,

  1152.                                  NULL) ||

  1153.       !BN_mod_exp(a.get(), e.get(), p.get(), m.get(), ctx)) {

  1154.     return false;

  1155.   }

  1156.   if (BN_cmp(a.get(), d.get()) != 0) {

  1157.     fprintf(stderr, "Modular exponentiation test failed!\n");

  1158.     return false;

  1159.   }

  1160. 

  1161.   return true;

  1162. }

  1163. 

  1164. static bool test_exp(FILE *fp, BN_CTX *ctx) {

  1165.   ScopedBIGNUM a(BN_new());

  1166.   ScopedBIGNUM b(BN_new());

  1167.   ScopedBIGNUM d(BN_new());

  1168.   ScopedBIGNUM e(BN_new());

  1169.   if (!a || !b || !d || !e) {

  1170.     return false;

  1171.   }

  1172. 

  1173.   for (int i = 0; i < num2; i++) {

  1174.     if (!BN_rand(a.get(), 20 + i * 5, 0, 0) ||

  1175.         !BN_rand(b.get(), 2 + i, 0, 0) ||

  1176.         !BN_exp(d.get(), a.get(), b.get(), ctx)) {

  1177.       return false;

  1178.     }

  1179. 

  1180.     if (fp != NULL) {

  1181.       BN_print_fp(fp, a.get());

  1182.       puts_fp(fp, " ^ ");

  1183.       BN_print_fp(fp, b.get());

  1184.       puts_fp(fp, " - ");

  1185.       BN_print_fp(fp, d.get());

  1186.       puts_fp(fp, "\n");

  1187.     }

  1188.     if (!BN_one(e.get())) {

  1189.       return false;

  1190.     }

  1191.     for (; !BN_is_zero(b.get()); BN_sub(b.get(), b.get(), BN_value_one())) {

  1192.       if (!BN_mul(e.get(), e.get(), a.get(), ctx)) {

  1193.         return false;

  1194.       }

  1195.     }

  1196.     if (!BN_sub(e.get(), e.get(), d.get())) {

  1197.       return false;

  1198.     }

  1199.     if (!BN_is_zero(e.get())) {

  1200.       fprintf(stderr, "Exponentiation test failed!\n");

  1201.       return false;

  1202.     }

  1203.   }

  1204.   return true;

  1205. }

  1206. 

  1207. // test_exp_mod_zero tests that 1**0 mod 1 == 0.

  1208. static bool test_exp_mod_zero(void) {

  1209.   ScopedBIGNUM zero(BN_new());

  1210.   if (!zero) {

  1211.     return false;

  1212.   }

  1213.   BN_zero(zero.get());

  1214. 

  1215.   ScopedBN_CTX ctx(BN_CTX_new());

  1216.   ScopedBIGNUM r(BN_new());

  1217.   if (!ctx || !r ||

  1218.       !BN_mod_exp(r.get(), BN_value_one(), zero.get(), BN_value_one(), ctx.get())) {

  1219.     return false;

  1220.   }

  1221. 

  1222.   if (!BN_is_zero(r.get())) {

  1223.     fprintf(stderr, "1**0 mod 1 = ");

  1224.     BN_print_fp(stderr, r.get());

  1225.     fprintf(stderr, ", should be 0\n");

  1226.     return false;

  1227.   }

  1228. 

  1229.   return true;

  1230. }

  1231. 

  1232. static bool test_mod_sqrt(FILE *fp, BN_CTX *ctx) {

  1233.   ScopedBIGNUM a(BN_new());

  1234.   ScopedBIGNUM p(BN_new());

  1235.   ScopedBIGNUM r(BN_new());

  1236.   if (!a || !p || !r) {

  1237.     return false;

  1238.   }

  1239. 

  1240.   for (int i = 0; i < 16; i++) {

  1241.     if (i < 8) {

  1242.       const unsigned kPrimes[8] = {2, 3, 5, 7, 11, 13, 17, 19};

  1243.       if (!BN_set_word(p.get(), kPrimes[i])) {

  1244.         return false;

  1245.       }

  1246.     } else {

  1247.       if (!BN_set_word(a.get(), 32) ||

  1248.           !BN_set_word(r.get(), 2 * i + 1) ||

  1249.           !BN_generate_prime_ex(p.get(), 256, 0, a.get(), r.get(), nullptr)) {

  1250.         return false;

  1251.       }

  1252.     }

  1253.     p->neg = rand_neg();

  1254. 

  1255.     for (int j = 0; j < num2; j++) {

  1256.       // construct 'a' such that it is a square modulo p, but in general not a

  1257.       // proper square and not reduced modulo p

  1258.       if (!BN_rand(r.get(), 256, 0, 3) ||

  1259.           !BN_nnmod(r.get(), r.get(), p.get(), ctx) ||

  1260.           !BN_mod_sqr(r.get(), r.get(), p.get(), ctx) ||

  1261.           !BN_rand(a.get(), 256, 0, 3) ||

  1262.           !BN_nnmod(a.get(), a.get(), p.get(), ctx) ||

  1263.           !BN_mod_sqr(a.get(), a.get(), p.get(), ctx) ||

  1264.           !BN_mul(a.get(), a.get(), r.get(), ctx)) {

  1265.         return false;

  1266.       }

  1267.       if (rand_neg() && !BN_sub(a.get(), a.get(), p.get())) {

  1268.         return false;

  1269.       }

  1270. 

  1271.       if (!BN_mod_sqrt(r.get(), a.get(), p.get(), ctx) ||

  1272.           !BN_mod_sqr(r.get(), r.get(), p.get(), ctx) ||

  1273.           !BN_nnmod(a.get(), a.get(), p.get(), ctx)) {

  1274.         return false;

  1275.       }

  1276. 

  1277.       if (BN_cmp(a.get(), r.get()) != 0) {

  1278.         fprintf(stderr, "BN_mod_sqrt failed: a = ");

  1279.         BN_print_fp(stderr, a.get());

  1280.         fprintf(stderr, ", r = ");

  1281.         BN_print_fp(stderr, r.get());

  1282.         fprintf(stderr, ", p = ");

  1283.         BN_print_fp(stderr, p.get());

  1284.         fprintf(stderr, "\n");

  1285.         return false;

  1286.       }

  1287.     }

  1288.   }

  1289.   return true;

  1290. }

  1291. 

  1292. static bool test_small_prime(FILE *fp, BN_CTX *ctx) {

  1293.   static const unsigned kBits = 10;

  1294. 

  1295.   ScopedBIGNUM r(BN_new());

  1296.   if (!r || !BN_generate_prime_ex(r.get(), static_cast<int>(kBits), 0, NULL,

  1297.                                   NULL, NULL)) {

  1298.     return false;

  1299.   }

  1300.   if (BN_num_bits(r.get()) != kBits) {

  1301.     fprintf(fp, "Expected %u bit prime, got %u bit number\n", kBits,

  1302.             BN_num_bits(r.get()));

  1303.     return false;

  1304.   }

  1305. 

  1306.   return true;

  1307. }

  1308. 

  1309. static bool test_sqrt(FILE *fp, BN_CTX *ctx) {

  1310.   ScopedBIGNUM n(BN_new());

  1311.   ScopedBIGNUM nn(BN_new());

  1312.   ScopedBIGNUM sqrt(BN_new());

  1313.   if (!n || !nn || !sqrt) {

  1314.     return false;

  1315.   }

  1316. 

  1317.   // Test some random squares.

  1318.   for (int i = 0; i < 100; i++) {

  1319.     if (!BN_rand(n.get(), 1024 /* bit length */,

  1320.                  -1 /* no modification of top bits */,

  1321.                  0 /* don't modify bottom bit */) ||

  1322.         !BN_mul(nn.get(), n.get(), n.get(), ctx) ||

  1323.         !BN_sqrt(sqrt.get(), nn.get(), ctx)) {

  1324.       ERR_print_errors_fp(stderr);

  1325.       return false;

  1326.     }

  1327.     if (BN_cmp(n.get(), sqrt.get()) != 0) {

  1328.       fprintf(stderr, "Bad result from BN_sqrt.\n");

  1329.       return false;

  1330.     }

  1331.   }

  1332. 

  1333.   // Test some non-squares.

  1334.   for (int i = 0; i < 100; i++) {

  1335.     if (!BN_rand(n.get(), 1024 /* bit length */,

  1336.                  -1 /* no modification of top bits */,

  1337.                  0 /* don't modify bottom bit */) ||

  1338.         !BN_mul(nn.get(), n.get(), n.get(), ctx) ||

  1339.         !BN_add(nn.get(), nn.get(), BN_value_one())) {

  1340.       ERR_print_errors_fp(stderr);

  1341.       return false;

  1342.     }

  1343. 

  1344.     if (BN_sqrt(sqrt.get(), nn.get(), ctx)) {

  1345.       char *nn_str = BN_bn2dec(nn.get());

  1346.       fprintf(stderr, "BIO_sqrt didn't fail on a non-square: %s\n", nn_str);

  1347.       OPENSSL_free(nn_str);

  1348.     }

  1349.   }

  1350. 

  1351.   return true;

  1352. }

  1353. 

  1354. static bool test_bn2bin_padded(BN_CTX *ctx) {

  1355.   uint8_t zeros[256], out[256], reference[128];

  1356. 

  1357.   memset(zeros, 0, sizeof(zeros));

  1358. 

  1359.   // Test edge case at 0.

  1360.   ScopedBIGNUM n(BN_new());

  1361.   if (!n || !BN_bn2bin_padded(NULL, 0, n.get())) {

  1362.     fprintf(stderr,

  1363.             "BN_bn2bin_padded failed to encode 0 in an empty buffer.\n");

  1364.     return false;

  1365.   }

  1366.   memset(out, -1, sizeof(out));

  1367.   if (!BN_bn2bin_padded(out, sizeof(out), n.get())) {

  1368.     fprintf(stderr,

  1369.             "BN_bn2bin_padded failed to encode 0 in a non-empty buffer.\n");

  1370.     return false;

  1371.   }

  1372.   if (memcmp(zeros, out, sizeof(out))) {

  1373.     fprintf(stderr, "BN_bn2bin_padded did not zero buffer.\n");

  1374.     return false;

  1375.   }

  1376. 

  1377.   // Test a random numbers at various byte lengths.

  1378.   for (size_t bytes = 128 - 7; bytes <= 128; bytes++) {

  1379.     if (!BN_rand(n.get(), bytes * 8, 0 /* make sure top bit is 1 */,

  1380.                  0 /* don't modify bottom bit */)) {

  1381.       ERR_print_errors_fp(stderr);

  1382.       return false;

  1383.     }

  1384.     if (BN_num_bytes(n.get()) != bytes ||

  1385.         BN_bn2bin(n.get(), reference) != bytes) {

  1386.       fprintf(stderr, "Bad result from BN_rand; bytes.\n");

  1387.       return false;

  1388.     }

  1389.     // Empty buffer should fail.

  1390.     if (BN_bn2bin_padded(NULL, 0, n.get())) {

  1391.       fprintf(stderr,

  1392.               "BN_bn2bin_padded incorrectly succeeded on empty buffer.\n");

  1393.       return false;

  1394.     }

  1395.     // One byte short should fail.

  1396.     if (BN_bn2bin_padded(out, bytes - 1, n.get())) {

  1397.       fprintf(stderr, "BN_bn2bin_padded incorrectly succeeded on short.\n");

  1398.       return false;

  1399.     }

  1400.     // Exactly right size should encode.

  1401.     if (!BN_bn2bin_padded(out, bytes, n.get()) ||

  1402.         memcmp(out, reference, bytes) != 0) {

  1403.       fprintf(stderr, "BN_bn2bin_padded gave a bad result.\n");

  1404.       return false;

  1405.     }

  1406.     // Pad up one byte extra.

  1407.     if (!BN_bn2bin_padded(out, bytes + 1, n.get()) ||

  1408.         memcmp(out + 1, reference, bytes) || memcmp(out, zeros, 1)) {

  1409.       fprintf(stderr, "BN_bn2bin_padded gave a bad result.\n");

  1410.       return false;

  1411.     }

  1412.     // Pad up to 256.

  1413.     if (!BN_bn2bin_padded(out, sizeof(out), n.get()) ||

  1414.         memcmp(out + sizeof(out) - bytes, reference, bytes) ||

  1415.         memcmp(out, zeros, sizeof(out) - bytes)) {

  1416.       fprintf(stderr, "BN_bn2bin_padded gave a bad result.\n");

  1417.       return false;

  1418.     }

  1419.   }

  1420. 

  1421.   return true;

  1422. }

  1423. 

  1424. static int DecimalToBIGNUM(ScopedBIGNUM *out, const char *in) {

  1425.   BIGNUM *raw = NULL;

  1426.   int ret = BN_dec2bn(&raw, in);

  1427.   out->reset(raw);

  1428.   return ret;

  1429. }

  1430. 

  1431. static bool test_dec2bn(BN_CTX *ctx) {

  1432.   ScopedBIGNUM bn;

  1433.   int ret = DecimalToBIGNUM(&bn, "0");

  1434.   if (ret != 1 || !BN_is_zero(bn.get()) || BN_is_negative(bn.get())) {

  1435.     fprintf(stderr, "BN_dec2bn gave a bad result.\n");

  1436.     return false;

  1437.   }

  1438. 

  1439.   ret = DecimalToBIGNUM(&bn, "256");

  1440.   if (ret != 3 || !BN_is_word(bn.get(), 256) || BN_is_negative(bn.get())) {

  1441.     fprintf(stderr, "BN_dec2bn gave a bad result.\n");

  1442.     return false;

  1443.   }

  1444. 

  1445.   ret = DecimalToBIGNUM(&bn, "-42");

  1446.   if (ret != 3 || !BN_abs_is_word(bn.get(), 42) || !BN_is_negative(bn.get())) {

  1447.     fprintf(stderr, "BN_dec2bn gave a bad result.\n");

  1448.     return false;

  1449.   }

  1450. 

  1451.   ret = DecimalToBIGNUM(&bn, "-0");

  1452.   if (ret != 2 || !BN_is_zero(bn.get()) || BN_is_negative(bn.get())) {

  1453.     fprintf(stderr, "BN_dec2bn gave a bad result.\n");

  1454.     return false;

  1455.   }

  1456. 

  1457.   ret = DecimalToBIGNUM(&bn, "42trailing garbage is ignored");

  1458.   if (ret != 2 || !BN_abs_is_word(bn.get(), 42) || BN_is_negative(bn.get())) {

  1459.     fprintf(stderr, "BN_dec2bn gave a bad result.\n");

  1460.     return false;

  1461.   }

  1462. 

  1463.   return true;

  1464. }

  1465. 

  1466. static int HexToBIGNUM(ScopedBIGNUM *out, const char *in) {

  1467.   BIGNUM *raw = NULL;

  1468.   int ret = BN_hex2bn(&raw, in);

  1469.   out->reset(raw);

  1470.   return ret;

  1471. }

  1472. 

  1473. static bool test_hex2bn(BN_CTX *ctx) {

  1474.   ScopedBIGNUM bn;

  1475.   int ret = HexToBIGNUM(&bn, "0");

  1476.   if (ret != 1 || !BN_is_zero(bn.get()) || BN_is_negative(bn.get())) {

  1477.     fprintf(stderr, "BN_hex2bn gave a bad result.\n");

  1478.     return false;

  1479.   }

  1480. 

  1481.   ret = HexToBIGNUM(&bn, "256");

  1482.   if (ret != 3 || !BN_is_word(bn.get(), 0x256) || BN_is_negative(bn.get())) {

  1483.     fprintf(stderr, "BN_hex2bn gave a bad result.\n");

  1484.     return false;

  1485.   }

  1486. 

  1487.   ret = HexToBIGNUM(&bn, "-42");

  1488.   if (ret != 3 || !BN_abs_is_word(bn.get(), 0x42) || !BN_is_negative(bn.get())) {

  1489.     fprintf(stderr, "BN_hex2bn gave a bad result.\n");

  1490.     return false;

  1491.   }

  1492. 

  1493.   ret = HexToBIGNUM(&bn, "-0");

  1494.   if (ret != 2 || !BN_is_zero(bn.get()) || BN_is_negative(bn.get())) {

  1495.     fprintf(stderr, "BN_hex2bn gave a bad result.\n");

  1496.     return false;

  1497.   }

  1498. 

  1499.   ret = HexToBIGNUM(&bn, "abctrailing garbage is ignored");

  1500.   if (ret != 3 || !BN_is_word(bn.get(), 0xabc) || BN_is_negative(bn.get())) {

  1501.     fprintf(stderr, "BN_hex2bn gave a bad result.\n");

  1502.     return false;

  1503.   }

  1504. 

  1505.   return true;

  1506. }

  1507. 

  1508. static ScopedBIGNUM ASCIIToBIGNUM(const char *in) {

  1509.   BIGNUM *raw = NULL;

  1510.   if (!BN_asc2bn(&raw, in)) {

  1511.     return nullptr;

  1512.   }

  1513.   return ScopedBIGNUM(raw);

  1514. }

  1515. 

  1516. static bool test_asc2bn(BN_CTX *ctx) {

  1517.   ScopedBIGNUM bn = ASCIIToBIGNUM("0");

  1518.   if (!bn || !BN_is_zero(bn.get()) || BN_is_negative(bn.get())) {

  1519.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1520.     return false;

  1521.   }

  1522. 

  1523.   bn = ASCIIToBIGNUM("256");

  1524.   if (!bn || !BN_is_word(bn.get(), 256) || BN_is_negative(bn.get())) {

  1525.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1526.     return false;

  1527.   }

  1528. 

  1529.   bn = ASCIIToBIGNUM("-42");

  1530.   if (!bn || !BN_abs_is_word(bn.get(), 42) || !BN_is_negative(bn.get())) {

  1531.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1532.     return false;

  1533.   }

  1534. 

  1535.   bn = ASCIIToBIGNUM("0x1234");

  1536.   if (!bn || !BN_is_word(bn.get(), 0x1234) || BN_is_negative(bn.get())) {

  1537.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1538.     return false;

  1539.   }

  1540. 

  1541.   bn = ASCIIToBIGNUM("0X1234");

  1542.   if (!bn || !BN_is_word(bn.get(), 0x1234) || BN_is_negative(bn.get())) {

  1543.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1544.     return false;

  1545.   }

  1546. 

  1547.   bn = ASCIIToBIGNUM("-0xabcd");

  1548.   if (!bn || !BN_abs_is_word(bn.get(), 0xabcd) || !BN_is_negative(bn.get())) {

  1549.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1550.     return false;

  1551.   }

  1552. 

  1553.   bn = ASCIIToBIGNUM("-0");

  1554.   if (!bn || !BN_is_zero(bn.get()) || BN_is_negative(bn.get())) {

  1555.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1556.     return false;

  1557.   }

  1558. 

  1559.   bn = ASCIIToBIGNUM("123trailing garbage is ignored");

  1560.   if (!bn || !BN_is_word(bn.get(), 123) || BN_is_negative(bn.get())) {

  1561.     fprintf(stderr, "BN_asc2bn gave a bad result.\n");

  1562.     return false;

  1563.   }

  1564. 

  1565.   return true;

  1566. }

  1567. 

  1568. static bool test_rand() {

  1569.   ScopedBIGNUM bn(BN_new());

  1570.   if (!bn) {

  1571.     return false;

  1572.   }

  1573. 

  1574.   // Test BN_rand accounts for degenerate cases with |top| and |bottom|

  1575.   // parameters.

  1576.   if (!BN_rand(bn.get(), 0, 0 /* top */, 0 /* bottom */) ||

  1577.       !BN_is_zero(bn.get())) {

  1578.     fprintf(stderr, "BN_rand gave a bad result.\n");

  1579.     return false;

  1580.   }

  1581.   if (!BN_rand(bn.get(), 0, 1 /* top */, 1 /* bottom */) ||

  1582.       !BN_is_zero(bn.get())) {

  1583.     fprintf(stderr, "BN_rand gave a bad result.\n");

  1584.     return false;

  1585.   }

  1586. 

  1587.   if (!BN_rand(bn.get(), 1, 0 /* top */, 0 /* bottom */) ||

  1588.       !BN_is_word(bn.get(), 1)) {

  1589.     fprintf(stderr, "BN_rand gave a bad result.\n");

  1590.     return false;

  1591.   }

  1592.   if (!BN_rand(bn.get(), 1, 1 /* top */, 0 /* bottom */) ||

  1593.       !BN_is_word(bn.get(), 1)) {

  1594.     fprintf(stderr, "BN_rand gave a bad result.\n");

  1595.     return false;

  1596.   }

  1597.   if (!BN_rand(bn.get(), 1, -1 /* top */, 1 /* bottom */) ||

  1598.       !BN_is_word(bn.get(), 1)) {

  1599.     fprintf(stderr, "BN_rand gave a bad result.\n");

  1600.     return false;

  1601.   }

  1602. 

  1603.   if (!BN_rand(bn.get(), 2, 1 /* top */, 0 /* bottom */) ||

  1604.       !BN_is_word(bn.get(), 3)) {

  1605.     fprintf(stderr, "BN_rand gave a bad result.\n");

  1606.     return false;

  1607.   }

  1608. 

  1609.   return true;

  1610. }

  1611. 

  1612. struct ASN1Test {

  1613.   const char *value_ascii;

  1614.   const char *der;

  1615.   size_t der_len;

  1616. };

  1617. 

  1618. static const ASN1Test kASN1Tests[] = {

  1619.     {"0", "\x02\x01\x00", 3},

  1620.     {"1", "\x02\x01\x01", 3},

  1621.     {"127", "\x02\x01\x7f", 3},

  1622.     {"128", "\x02\x02\x00\x80", 4},

  1623.     {"0xdeadbeef", "\x02\x05\x00\xde\xad\xbe\xef", 7},

  1624.     {"0x0102030405060708",

  1625.      "\x02\x08\x01\x02\x03\x04\x05\x06\x07\x08", 10},

  1626.     {"0xffffffffffffffff",

  1627.       "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff", 11},

  1628. };

  1629. 

  1630. struct ASN1InvalidTest {

  1631.   const char *der;

  1632.   size_t der_len;

  1633. };

  1634. 

  1635. static const ASN1InvalidTest kASN1InvalidTests[] = {

  1636.     // Bad tag.

  1637.     {"\x03\x01\x00", 3},

  1638.     // Empty contents.

  1639.     {"\x02\x00", 2},

  1640.     // Negative number.

  1641.     {"\x02\x01\x80", 3},

  1642.     // Leading zeros.

  1643.     {"\x02\x02\x00\x01", 4},

  1644. };

  1645. 

  1646. static bool test_asn1() {

  1647.   for (const ASN1Test &test : kASN1Tests) {

  1648.     ScopedBIGNUM bn = ASCIIToBIGNUM(test.value_ascii);

  1649.     if (!bn) {

  1650.       return false;

  1651.     }

  1652. 

  1653.     // Test that the input is correctly parsed.

  1654.     ScopedBIGNUM bn2(BN_new());

  1655.     if (!bn2) {

  1656.       return false;

  1657.     }

  1658.     CBS cbs;

  1659.     CBS_init(&cbs, reinterpret_cast<const uint8_t*>(test.der), test.der_len);

  1660.     if (!BN_cbs2unsigned(&cbs, bn2.get()) || CBS_len(&cbs) != 0) {

  1661.       fprintf(stderr, "Parsing ASN.1 INTEGER failed.\n");

  1662.       return false;

  1663.     }

  1664.     if (BN_cmp(bn.get(), bn2.get()) != 0) {

  1665.       fprintf(stderr, "Bad parse.\n");

  1666.       return false;

  1667.     }

  1668. 

  1669.     // Test the value serializes correctly.

  1670.     CBB cbb;

  1671.     uint8_t *der;

  1672.     size_t der_len;

  1673.     CBB_zero(&cbb);

  1674.     if (!CBB_init(&cbb, 0) ||

  1675.         !BN_bn2cbb(&cbb, bn.get()) ||

  1676.         !CBB_finish(&cbb, &der, &der_len)) {

  1677.       CBB_cleanup(&cbb);

  1678.       return false;

  1679.     }

  1680.     ScopedOpenSSLBytes delete_der(der);

  1681.     if (der_len != test.der_len ||

  1682.         memcmp(der, reinterpret_cast<const uint8_t*>(test.der), der_len) != 0) {

  1683.       fprintf(stderr, "Bad serialization.\n");

  1684.       return false;

  1685.     }

  1686.   }

  1687. 

  1688.   for (const ASN1InvalidTest &test : kASN1InvalidTests) {

  1689.     ScopedBIGNUM bn(BN_new());

  1690.     if (!bn) {

  1691.       return false;

  1692.     }

  1693.     CBS cbs;

  1694.     CBS_init(&cbs, reinterpret_cast<const uint8_t*>(test.der), test.der_len);

  1695.     if (BN_cbs2unsigned(&cbs, bn.get())) {

  1696.       fprintf(stderr, "Parsed invalid input.\n");

  1697.       return false;

  1698.     }

  1699.     ERR_clear_error();

  1700.   }

  1701. 

  1702.   // Serializing negative numbers is not supported.

  1703.   ScopedBIGNUM bn = ASCIIToBIGNUM("-1");

  1704.   if (!bn) {

  1705.     return false;

  1706.   }

  1707.   CBB cbb;

  1708.   CBB_zero(&cbb);

  1709.   if (!CBB_init(&cbb, 0) ||

  1710.       BN_bn2cbb(&cbb, bn.get())) {

  1711.     fprintf(stderr, "Serialized negative number.\n");

  1712.     CBB_cleanup(&cbb);

  1713.     return false;

  1714.   }

  1715.   CBB_cleanup(&cbb);

  1716. 

  1717.   return true;

  1718. }