2
0

bntest.c 65 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287
  1. /*
  2. * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <assert.h>
  10. #include <errno.h>
  11. #include <stdio.h>
  12. #include <string.h>
  13. #include <ctype.h>
  14. #include <openssl/bn.h>
  15. #include <openssl/crypto.h>
  16. #include <openssl/err.h>
  17. #include <openssl/rand.h>
  18. #include "internal/nelem.h"
  19. #include "internal/numbers.h"
  20. #include "testutil.h"
  21. #ifdef OPENSSL_SYS_WINDOWS
  22. # define strcasecmp _stricmp
  23. #endif
  24. /*
  25. * Things in boring, not in openssl. TODO we should add them.
  26. */
  27. #define HAVE_BN_PADDED 0
  28. #define HAVE_BN_SQRT 0
  29. typedef struct filetest_st {
  30. const char *name;
  31. int (*func)(STANZA *s);
  32. } FILETEST;
  33. typedef struct mpitest_st {
  34. const char *base10;
  35. const char *mpi;
  36. size_t mpi_len;
  37. } MPITEST;
  38. static const int NUM0 = 100; /* number of tests */
  39. static const int NUM1 = 50; /* additional tests for some functions */
  40. static BN_CTX *ctx;
  41. /*
  42. * Polynomial coefficients used in GFM tests.
  43. */
  44. #ifndef OPENSSL_NO_EC2M
  45. static int p0[] = { 163, 7, 6, 3, 0, -1 };
  46. static int p1[] = { 193, 15, 0, -1 };
  47. #endif
  48. /*
  49. * Look for |key| in the stanza and return it or NULL if not found.
  50. */
  51. static const char *findattr(STANZA *s, const char *key)
  52. {
  53. int i = s->numpairs;
  54. PAIR *pp = s->pairs;
  55. for ( ; --i >= 0; pp++)
  56. if (strcasecmp(pp->key, key) == 0)
  57. return pp->value;
  58. return NULL;
  59. }
  60. /*
  61. * Parse BIGNUM from sparse hex-strings, return |BN_hex2bn| result.
  62. */
  63. static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  64. {
  65. char *bigstring = glue_strings(bn_strings, NULL);
  66. int ret = BN_hex2bn(out, bigstring);
  67. OPENSSL_free(bigstring);
  68. return ret;
  69. }
  70. /*
  71. * Parse BIGNUM, return number of bytes parsed.
  72. */
  73. static int parseBN(BIGNUM **out, const char *in)
  74. {
  75. *out = NULL;
  76. return BN_hex2bn(out, in);
  77. }
  78. static int parsedecBN(BIGNUM **out, const char *in)
  79. {
  80. *out = NULL;
  81. return BN_dec2bn(out, in);
  82. }
  83. static BIGNUM *getBN(STANZA *s, const char *attribute)
  84. {
  85. const char *hex;
  86. BIGNUM *ret = NULL;
  87. if ((hex = findattr(s, attribute)) == NULL) {
  88. TEST_error("%s:%d: Can't find %s", s->test_file, s->start, attribute);
  89. return NULL;
  90. }
  91. if (parseBN(&ret, hex) != (int)strlen(hex)) {
  92. TEST_error("Could not decode '%s'", hex);
  93. return NULL;
  94. }
  95. return ret;
  96. }
  97. static int getint(STANZA *s, int *out, const char *attribute)
  98. {
  99. BIGNUM *ret;
  100. BN_ULONG word;
  101. int st = 0;
  102. if (!TEST_ptr(ret = getBN(s, attribute))
  103. || !TEST_ulong_le(word = BN_get_word(ret), INT_MAX))
  104. goto err;
  105. *out = (int)word;
  106. st = 1;
  107. err:
  108. BN_free(ret);
  109. return st;
  110. }
  111. static int equalBN(const char *op, const BIGNUM *expected, const BIGNUM *actual)
  112. {
  113. if (BN_cmp(expected, actual) == 0)
  114. return 1;
  115. TEST_error("unexpected %s value", op);
  116. TEST_BN_eq(expected, actual);
  117. return 0;
  118. }
  119. /*
  120. * Return a "random" flag for if a BN should be negated.
  121. */
  122. static int rand_neg(void)
  123. {
  124. static unsigned int neg = 0;
  125. static int sign[8] = { 0, 0, 0, 1, 1, 0, 1, 1 };
  126. return sign[(neg++) % 8];
  127. }
  128. static int test_swap(void)
  129. {
  130. BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL;
  131. int top, cond, st = 0;
  132. if (!TEST_ptr(a = BN_new())
  133. || !TEST_ptr(b = BN_new())
  134. || !TEST_ptr(c = BN_new())
  135. || !TEST_ptr(d = BN_new()))
  136. goto err;
  137. BN_bntest_rand(a, 1024, 1, 0);
  138. BN_bntest_rand(b, 1024, 1, 0);
  139. BN_copy(c, a);
  140. BN_copy(d, b);
  141. top = BN_num_bits(a)/BN_BITS2;
  142. /* regular swap */
  143. BN_swap(a, b);
  144. if (!equalBN("swap", a, d)
  145. || !equalBN("swap", b, c))
  146. goto err;
  147. /* conditional swap: true */
  148. cond = 1;
  149. BN_consttime_swap(cond, a, b, top);
  150. if (!equalBN("cswap true", a, c)
  151. || !equalBN("cswap true", b, d))
  152. goto err;
  153. /* conditional swap: false */
  154. cond = 0;
  155. BN_consttime_swap(cond, a, b, top);
  156. if (!equalBN("cswap false", a, c)
  157. || !equalBN("cswap false", b, d))
  158. goto err;
  159. /* same tests but checking flag swap */
  160. BN_set_flags(a, BN_FLG_CONSTTIME);
  161. BN_swap(a, b);
  162. if (!equalBN("swap, flags", a, d)
  163. || !equalBN("swap, flags", b, c)
  164. || !TEST_true(BN_get_flags(b, BN_FLG_CONSTTIME))
  165. || !TEST_false(BN_get_flags(a, BN_FLG_CONSTTIME)))
  166. goto err;
  167. cond = 1;
  168. BN_consttime_swap(cond, a, b, top);
  169. if (!equalBN("cswap true, flags", a, c)
  170. || !equalBN("cswap true, flags", b, d)
  171. || !TEST_true(BN_get_flags(a, BN_FLG_CONSTTIME))
  172. || !TEST_false(BN_get_flags(b, BN_FLG_CONSTTIME)))
  173. goto err;
  174. cond = 0;
  175. BN_consttime_swap(cond, a, b, top);
  176. if (!equalBN("cswap false, flags", a, c)
  177. || !equalBN("cswap false, flags", b, d)
  178. || !TEST_true(BN_get_flags(a, BN_FLG_CONSTTIME))
  179. || !TEST_false(BN_get_flags(b, BN_FLG_CONSTTIME)))
  180. goto err;
  181. st = 1;
  182. err:
  183. BN_free(a);
  184. BN_free(b);
  185. BN_free(c);
  186. BN_free(d);
  187. return st;
  188. }
  189. static int test_sub(void)
  190. {
  191. BIGNUM *a = NULL, *b = NULL, *c = NULL;
  192. int i, st = 0;
  193. if (!TEST_ptr(a = BN_new())
  194. || !TEST_ptr(b = BN_new())
  195. || !TEST_ptr(c = BN_new()))
  196. goto err;
  197. for (i = 0; i < NUM0 + NUM1; i++) {
  198. if (i < NUM1) {
  199. BN_bntest_rand(a, 512, 0, 0);
  200. BN_copy(b, a);
  201. if (!TEST_int_ne(BN_set_bit(a, i), 0))
  202. goto err;
  203. BN_add_word(b, i);
  204. } else {
  205. BN_bntest_rand(b, 400 + i - NUM1, 0, 0);
  206. BN_set_negative(a, rand_neg());
  207. BN_set_negative(b, rand_neg());
  208. }
  209. BN_sub(c, a, b);
  210. BN_add(c, c, b);
  211. BN_sub(c, c, a);
  212. if (!TEST_BN_eq_zero(c))
  213. goto err;
  214. }
  215. st = 1;
  216. err:
  217. BN_free(a);
  218. BN_free(b);
  219. BN_free(c);
  220. return st;
  221. }
  222. static int test_div_recip(void)
  223. {
  224. BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL, *e = NULL;
  225. BN_RECP_CTX *recp = NULL;
  226. int st = 0, i;
  227. if (!TEST_ptr(a = BN_new())
  228. || !TEST_ptr(b = BN_new())
  229. || !TEST_ptr(c = BN_new())
  230. || !TEST_ptr(d = BN_new())
  231. || !TEST_ptr(e = BN_new())
  232. || !TEST_ptr(recp = BN_RECP_CTX_new()))
  233. goto err;
  234. for (i = 0; i < NUM0 + NUM1; i++) {
  235. if (i < NUM1) {
  236. BN_bntest_rand(a, 400, 0, 0);
  237. BN_copy(b, a);
  238. BN_lshift(a, a, i);
  239. BN_add_word(a, i);
  240. } else
  241. BN_bntest_rand(b, 50 + 3 * (i - NUM1), 0, 0);
  242. BN_set_negative(a, rand_neg());
  243. BN_set_negative(b, rand_neg());
  244. BN_RECP_CTX_set(recp, b, ctx);
  245. BN_div_recp(d, c, a, recp, ctx);
  246. BN_mul(e, d, b, ctx);
  247. BN_add(d, e, c);
  248. BN_sub(d, d, a);
  249. if (!TEST_BN_eq_zero(d))
  250. goto err;
  251. }
  252. st = 1;
  253. err:
  254. BN_free(a);
  255. BN_free(b);
  256. BN_free(c);
  257. BN_free(d);
  258. BN_free(e);
  259. BN_RECP_CTX_free(recp);
  260. return st;
  261. }
  262. static int test_mod(void)
  263. {
  264. BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL, *e = NULL;
  265. int st = 0, i;
  266. if (!TEST_ptr(a = BN_new())
  267. || !TEST_ptr(b = BN_new())
  268. || !TEST_ptr(c = BN_new())
  269. || !TEST_ptr(d = BN_new())
  270. || !TEST_ptr(e = BN_new()))
  271. goto err;
  272. BN_bntest_rand(a, 1024, 0, 0);
  273. for (i = 0; i < NUM0; i++) {
  274. BN_bntest_rand(b, 450 + i * 10, 0, 0);
  275. BN_set_negative(a, rand_neg());
  276. BN_set_negative(b, rand_neg());
  277. BN_mod(c, a, b, ctx);
  278. BN_div(d, e, a, b, ctx);
  279. BN_sub(e, e, c);
  280. if (!TEST_BN_eq_zero(e))
  281. goto err;
  282. }
  283. st = 1;
  284. err:
  285. BN_free(a);
  286. BN_free(b);
  287. BN_free(c);
  288. BN_free(d);
  289. BN_free(e);
  290. return st;
  291. }
  292. static const char *bn1strings[] = {
  293. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  294. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  295. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  296. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  297. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  298. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  299. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  300. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000000000FFFFFFFF00",
  301. "0000000000000000000000000000000000000000000000000000000000000000",
  302. "0000000000000000000000000000000000000000000000000000000000000000",
  303. "0000000000000000000000000000000000000000000000000000000000000000",
  304. "0000000000000000000000000000000000000000000000000000000000000000",
  305. "0000000000000000000000000000000000000000000000000000000000000000",
  306. "0000000000000000000000000000000000000000000000000000000000000000",
  307. "0000000000000000000000000000000000000000000000000000000000000000",
  308. "00000000000000000000000000000000000000000000000000FFFFFFFFFFFFFF",
  309. NULL
  310. };
  311. static const char *bn2strings[] = {
  312. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  313. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  314. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  315. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  316. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  317. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  318. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  319. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000000000FFFFFFFF0000000000",
  320. "0000000000000000000000000000000000000000000000000000000000000000",
  321. "0000000000000000000000000000000000000000000000000000000000000000",
  322. "0000000000000000000000000000000000000000000000000000000000000000",
  323. "0000000000000000000000000000000000000000000000000000000000000000",
  324. "0000000000000000000000000000000000000000000000000000000000000000",
  325. "0000000000000000000000000000000000000000000000000000000000000000",
  326. "0000000000000000000000000000000000000000000000000000000000000000",
  327. "000000000000000000000000000000000000000000FFFFFFFFFFFFFF00000000",
  328. NULL
  329. };
  330. /*
  331. * Test constant-time modular exponentiation with 1024-bit inputs, which on
  332. * x86_64 cause a different code branch to be taken.
  333. */
  334. static int test_modexp_mont5(void)
  335. {
  336. BIGNUM *a = NULL, *p = NULL, *m = NULL, *d = NULL, *e = NULL;
  337. BIGNUM *b = NULL, *n = NULL, *c = NULL;
  338. BN_MONT_CTX *mont = NULL;
  339. int st = 0;
  340. if (!TEST_ptr(a = BN_new())
  341. || !TEST_ptr(p = BN_new())
  342. || !TEST_ptr(m = BN_new())
  343. || !TEST_ptr(d = BN_new())
  344. || !TEST_ptr(e = BN_new())
  345. || !TEST_ptr(b = BN_new())
  346. || !TEST_ptr(n = BN_new())
  347. || !TEST_ptr(c = BN_new())
  348. || !TEST_ptr(mont = BN_MONT_CTX_new()))
  349. goto err;
  350. BN_bntest_rand(m, 1024, 0, 1); /* must be odd for montgomery */
  351. /* Zero exponent */
  352. BN_bntest_rand(a, 1024, 0, 0);
  353. BN_zero(p);
  354. if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL)))
  355. goto err;
  356. if (!TEST_BN_eq_one(d))
  357. goto err;
  358. /* Regression test for carry bug in mulx4x_mont */
  359. BN_hex2bn(&a,
  360. "7878787878787878787878787878787878787878787878787878787878787878"
  361. "7878787878787878787878787878787878787878787878787878787878787878"
  362. "7878787878787878787878787878787878787878787878787878787878787878"
  363. "7878787878787878787878787878787878787878787878787878787878787878");
  364. BN_hex2bn(&b,
  365. "095D72C08C097BA488C5E439C655A192EAFB6380073D8C2664668EDDB4060744"
  366. "E16E57FB4EDB9AE10A0CEFCDC28A894F689A128379DB279D48A2E20849D68593"
  367. "9B7803BCF46CEBF5C533FB0DD35B080593DE5472E3FE5DB951B8BFF9B4CB8F03"
  368. "9CC638A5EE8CDD703719F8000E6A9F63BEED5F2FCD52FF293EA05A251BB4AB81");
  369. BN_hex2bn(&n,
  370. "D78AF684E71DB0C39CFF4E64FB9DB567132CB9C50CC98009FEB820B26F2DED9B"
  371. "91B9B5E2B83AE0AE4EB4E0523CA726BFBE969B89FD754F674CE99118C3F2D1C5"
  372. "D81FDC7C54E02B60262B241D53C040E99E45826ECA37A804668E690E1AFC1CA4"
  373. "2C9A15D84D4954425F0B7642FC0BD9D7B24E2618D2DCC9B729D944BADACFDDAF");
  374. BN_MONT_CTX_set(mont, n, ctx);
  375. BN_mod_mul_montgomery(c, a, b, mont, ctx);
  376. BN_mod_mul_montgomery(d, b, a, mont, ctx);
  377. if (!TEST_BN_eq(c, d))
  378. goto err;
  379. /* Regression test for carry bug in sqr[x]8x_mont */
  380. parse_bigBN(&n, bn1strings);
  381. parse_bigBN(&a, bn2strings);
  382. BN_free(b);
  383. b = BN_dup(a);
  384. BN_MONT_CTX_set(mont, n, ctx);
  385. BN_mod_mul_montgomery(c, a, a, mont, ctx);
  386. BN_mod_mul_montgomery(d, a, b, mont, ctx);
  387. if (!TEST_BN_eq(c, d))
  388. goto err;
  389. /* Regression test for carry bug in bn_sqrx8x_internal */
  390. {
  391. static const char *ahex[] = {
  392. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  393. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  394. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  395. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  396. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8FFEADBCFC4DAE7FFF908E92820306B",
  397. "9544D954000000006C0000000000000000000000000000000000000000000000",
  398. "00000000000000000000FF030202FFFFF8FFEBDBCFC4DAE7FFF908E92820306B",
  399. "9544D954000000006C000000FF0302030000000000FFFFFFFFFFFFFFFFFFFFFF",
  400. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01FC00FF02FFFFFFFF",
  401. "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00FCFD",
  402. "FCFFFFFFFFFF000000000000000000FF0302030000000000FFFFFFFFFFFFFFFF",
  403. "FF00FCFDFDFF030202FF00000000FFFFFFFFFFFFFFFFFF00FCFDFCFFFFFFFFFF",
  404. NULL
  405. };
  406. static const char *nhex[] = {
  407. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  408. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  409. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  410. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  411. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8F8F8F8000000",
  412. "00000010000000006C0000000000000000000000000000000000000000000000",
  413. "00000000000000000000000000000000000000FFFFFFFFFFFFF8F8F8F8000000",
  414. "00000010000000006C000000000000000000000000FFFFFFFFFFFFFFFFFFFFFF",
  415. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  416. "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  417. "FFFFFFFFFFFF000000000000000000000000000000000000FFFFFFFFFFFFFFFF",
  418. "FFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
  419. NULL
  420. };
  421. parse_bigBN(&a, ahex);
  422. parse_bigBN(&n, nhex);
  423. }
  424. BN_free(b);
  425. b = BN_dup(a);
  426. BN_MONT_CTX_set(mont, n, ctx);
  427. if (!TEST_true(BN_mod_mul_montgomery(c, a, a, mont, ctx))
  428. || !TEST_true(BN_mod_mul_montgomery(d, a, b, mont, ctx))
  429. || !TEST_BN_eq(c, d))
  430. goto err;
  431. /* Regression test for bug in BN_from_montgomery_word */
  432. BN_hex2bn(&a,
  433. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  434. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  435. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
  436. BN_hex2bn(&n,
  437. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  438. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
  439. BN_MONT_CTX_set(mont, n, ctx);
  440. if (!TEST_false(BN_mod_mul_montgomery(d, a, a, mont, ctx)))
  441. goto err;
  442. /* Regression test for bug in rsaz_1024_mul_avx2 */
  443. BN_hex2bn(&a,
  444. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  445. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  446. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  447. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020DF");
  448. BN_hex2bn(&b,
  449. "2020202020202020202020202020202020202020202020202020202020202020"
  450. "2020202020202020202020202020202020202020202020202020202020202020"
  451. "20202020202020FF202020202020202020202020202020202020202020202020"
  452. "2020202020202020202020202020202020202020202020202020202020202020");
  453. BN_hex2bn(&n,
  454. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  455. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  456. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
  457. "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020FF");
  458. BN_MONT_CTX_set(mont, n, ctx);
  459. BN_mod_exp_mont_consttime(c, a, b, n, ctx, mont);
  460. BN_mod_exp_mont(d, a, b, n, ctx, mont);
  461. if (!TEST_BN_eq(c, d))
  462. goto err;
  463. /* Zero input */
  464. BN_bntest_rand(p, 1024, 0, 0);
  465. BN_zero(a);
  466. if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))
  467. || !TEST_BN_eq_zero(d))
  468. goto err;
  469. /*
  470. * Craft an input whose Montgomery representation is 1, i.e., shorter
  471. * than the modulus m, in order to test the const time precomputation
  472. * scattering/gathering.
  473. */
  474. BN_one(a);
  475. BN_MONT_CTX_set(mont, m, ctx);
  476. if (!TEST_true(BN_from_montgomery(e, a, mont, ctx))
  477. || !TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))
  478. || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))
  479. || !TEST_BN_eq(a, d))
  480. goto err;
  481. /* Finally, some regular test vectors. */
  482. BN_bntest_rand(e, 1024, 0, 0);
  483. if (!TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))
  484. || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))
  485. || !TEST_BN_eq(a, d))
  486. goto err;
  487. st = 1;
  488. err:
  489. BN_MONT_CTX_free(mont);
  490. BN_free(a);
  491. BN_free(p);
  492. BN_free(m);
  493. BN_free(d);
  494. BN_free(e);
  495. BN_free(b);
  496. BN_free(n);
  497. BN_free(c);
  498. return st;
  499. }
  500. #ifndef OPENSSL_NO_EC2M
  501. static int test_gf2m_add(void)
  502. {
  503. BIGNUM *a = NULL, *b = NULL, *c = NULL;
  504. int i, st = 0;
  505. if (!TEST_ptr(a = BN_new())
  506. || !TEST_ptr(b = BN_new())
  507. || !TEST_ptr(c = BN_new()))
  508. goto err;
  509. for (i = 0; i < NUM0; i++) {
  510. BN_rand(a, 512, 0, 0);
  511. BN_copy(b, BN_value_one());
  512. BN_set_negative(a, rand_neg());
  513. BN_set_negative(b, rand_neg());
  514. BN_GF2m_add(c, a, b);
  515. /* Test that two added values have the correct parity. */
  516. if (!TEST_false((BN_is_odd(a) && BN_is_odd(c))
  517. || (!BN_is_odd(a) && !BN_is_odd(c))))
  518. goto err;
  519. BN_GF2m_add(c, c, c);
  520. /* Test that c + c = 0. */
  521. if (!TEST_BN_eq_zero(c))
  522. goto err;
  523. }
  524. st = 1;
  525. err:
  526. BN_free(a);
  527. BN_free(b);
  528. BN_free(c);
  529. return st;
  530. }
  531. static int test_gf2m_mod(void)
  532. {
  533. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL, *e = NULL;
  534. int i, j, st = 0;
  535. if (!TEST_ptr(a = BN_new())
  536. || !TEST_ptr(b[0] = BN_new())
  537. || !TEST_ptr(b[1] = BN_new())
  538. || !TEST_ptr(c = BN_new())
  539. || !TEST_ptr(d = BN_new())
  540. || !TEST_ptr(e = BN_new()))
  541. goto err;
  542. BN_GF2m_arr2poly(p0, b[0]);
  543. BN_GF2m_arr2poly(p1, b[1]);
  544. for (i = 0; i < NUM0; i++) {
  545. BN_bntest_rand(a, 1024, 0, 0);
  546. for (j = 0; j < 2; j++) {
  547. BN_GF2m_mod(c, a, b[j]);
  548. BN_GF2m_add(d, a, c);
  549. BN_GF2m_mod(e, d, b[j]);
  550. /* Test that a + (a mod p) mod p == 0. */
  551. if (!TEST_BN_eq_zero(e))
  552. goto err;
  553. }
  554. }
  555. st = 1;
  556. err:
  557. BN_free(a);
  558. BN_free(b[0]);
  559. BN_free(b[1]);
  560. BN_free(c);
  561. BN_free(d);
  562. BN_free(e);
  563. return st;
  564. }
  565. static int test_gf2m_mul(void)
  566. {
  567. BIGNUM *a, *b[2] = {NULL, NULL}, *c = NULL, *d = NULL;
  568. BIGNUM *e = NULL, *f = NULL, *g = NULL, *h = NULL;
  569. int i, j, st = 0;
  570. if (!TEST_ptr(a = BN_new())
  571. || !TEST_ptr(b[0] = BN_new())
  572. || !TEST_ptr(b[1] = BN_new())
  573. || !TEST_ptr(c = BN_new())
  574. || !TEST_ptr(d = BN_new())
  575. || !TEST_ptr(e = BN_new())
  576. || !TEST_ptr(f = BN_new())
  577. || !TEST_ptr(g = BN_new())
  578. || !TEST_ptr(h = BN_new()))
  579. goto err;
  580. BN_GF2m_arr2poly(p0, b[0]);
  581. BN_GF2m_arr2poly(p1, b[1]);
  582. for (i = 0; i < NUM0; i++) {
  583. BN_bntest_rand(a, 1024, 0, 0);
  584. BN_bntest_rand(c, 1024, 0, 0);
  585. BN_bntest_rand(d, 1024, 0, 0);
  586. for (j = 0; j < 2; j++) {
  587. BN_GF2m_mod_mul(e, a, c, b[j], ctx);
  588. BN_GF2m_add(f, a, d);
  589. BN_GF2m_mod_mul(g, f, c, b[j], ctx);
  590. BN_GF2m_mod_mul(h, d, c, b[j], ctx);
  591. BN_GF2m_add(f, e, g);
  592. BN_GF2m_add(f, f, h);
  593. /* Test that (a+d)*c = a*c + d*c. */
  594. if (!TEST_BN_eq_zero(f))
  595. goto err;
  596. }
  597. }
  598. st = 1;
  599. err:
  600. BN_free(a);
  601. BN_free(b[0]);
  602. BN_free(b[1]);
  603. BN_free(c);
  604. BN_free(d);
  605. BN_free(e);
  606. BN_free(f);
  607. BN_free(g);
  608. BN_free(h);
  609. return st;
  610. }
  611. static int test_gf2m_sqr(void)
  612. {
  613. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
  614. int i, j, st = 0;
  615. if (!TEST_ptr(a = BN_new())
  616. || !TEST_ptr(b[0] = BN_new())
  617. || !TEST_ptr(b[1] = BN_new())
  618. || !TEST_ptr(c = BN_new())
  619. || !TEST_ptr(d = BN_new()))
  620. goto err;
  621. BN_GF2m_arr2poly(p0, b[0]);
  622. BN_GF2m_arr2poly(p1, b[1]);
  623. for (i = 0; i < NUM0; i++) {
  624. BN_bntest_rand(a, 1024, 0, 0);
  625. for (j = 0; j < 2; j++) {
  626. BN_GF2m_mod_sqr(c, a, b[j], ctx);
  627. BN_copy(d, a);
  628. BN_GF2m_mod_mul(d, a, d, b[j], ctx);
  629. BN_GF2m_add(d, c, d);
  630. /* Test that a*a = a^2. */
  631. if (!TEST_BN_eq_zero(d))
  632. goto err;
  633. }
  634. }
  635. st = 1;
  636. err:
  637. BN_free(a);
  638. BN_free(b[0]);
  639. BN_free(b[1]);
  640. BN_free(c);
  641. BN_free(d);
  642. return st;
  643. }
  644. static int test_gf2m_modinv(void)
  645. {
  646. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
  647. int i, j, st = 0;
  648. if (!TEST_ptr(a = BN_new())
  649. || !TEST_ptr(b[0] = BN_new())
  650. || !TEST_ptr(b[1] = BN_new())
  651. || !TEST_ptr(c = BN_new())
  652. || !TEST_ptr(d = BN_new()))
  653. goto err;
  654. BN_GF2m_arr2poly(p0, b[0]);
  655. BN_GF2m_arr2poly(p1, b[1]);
  656. for (i = 0; i < NUM0; i++) {
  657. BN_bntest_rand(a, 512, 0, 0);
  658. for (j = 0; j < 2; j++) {
  659. BN_GF2m_mod_inv(c, a, b[j], ctx);
  660. BN_GF2m_mod_mul(d, a, c, b[j], ctx);
  661. /* Test that ((1/a)*a) = 1. */
  662. if (!TEST_BN_eq_one(d))
  663. goto err;
  664. }
  665. }
  666. st = 1;
  667. err:
  668. BN_free(a);
  669. BN_free(b[0]);
  670. BN_free(b[1]);
  671. BN_free(c);
  672. BN_free(d);
  673. return st;
  674. }
  675. static int test_gf2m_moddiv(void)
  676. {
  677. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
  678. BIGNUM *e = NULL, *f = NULL;
  679. int i, j, st = 0;
  680. if (!TEST_ptr(a = BN_new())
  681. || !TEST_ptr(b[0] = BN_new())
  682. || !TEST_ptr(b[1] = BN_new())
  683. || !TEST_ptr(c = BN_new())
  684. || !TEST_ptr(d = BN_new())
  685. || !TEST_ptr(e = BN_new())
  686. || !TEST_ptr(f = BN_new()))
  687. goto err;
  688. BN_GF2m_arr2poly(p0, b[0]);
  689. BN_GF2m_arr2poly(p1, b[1]);
  690. for (i = 0; i < NUM0; i++) {
  691. BN_bntest_rand(a, 512, 0, 0);
  692. BN_bntest_rand(c, 512, 0, 0);
  693. for (j = 0; j < 2; j++) {
  694. BN_GF2m_mod_div(d, a, c, b[j], ctx);
  695. BN_GF2m_mod_mul(e, d, c, b[j], ctx);
  696. BN_GF2m_mod_div(f, a, e, b[j], ctx);
  697. /* Test that ((a/c)*c)/a = 1. */
  698. if (!TEST_BN_eq_one(f))
  699. goto err;
  700. }
  701. }
  702. st = 1;
  703. err:
  704. BN_free(a);
  705. BN_free(b[0]);
  706. BN_free(b[1]);
  707. BN_free(c);
  708. BN_free(d);
  709. BN_free(e);
  710. BN_free(f);
  711. return st;
  712. }
  713. static int test_gf2m_modexp(void)
  714. {
  715. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
  716. BIGNUM *e = NULL, *f = NULL;
  717. int i, j, st = 0;
  718. if (!TEST_ptr(a = BN_new())
  719. || !TEST_ptr(b[0] = BN_new())
  720. || !TEST_ptr(b[1] = BN_new())
  721. || !TEST_ptr(c = BN_new())
  722. || !TEST_ptr(d = BN_new())
  723. || !TEST_ptr(e = BN_new())
  724. || !TEST_ptr(f = BN_new()))
  725. goto err;
  726. BN_GF2m_arr2poly(p0, b[0]);
  727. BN_GF2m_arr2poly(p1, b[1]);
  728. for (i = 0; i < NUM0; i++) {
  729. BN_bntest_rand(a, 512, 0, 0);
  730. BN_bntest_rand(c, 512, 0, 0);
  731. BN_bntest_rand(d, 512, 0, 0);
  732. for (j = 0; j < 2; j++) {
  733. BN_GF2m_mod_exp(e, a, c, b[j], ctx);
  734. BN_GF2m_mod_exp(f, a, d, b[j], ctx);
  735. BN_GF2m_mod_mul(e, e, f, b[j], ctx);
  736. BN_add(f, c, d);
  737. BN_GF2m_mod_exp(f, a, f, b[j], ctx);
  738. BN_GF2m_add(f, e, f);
  739. /* Test that a^(c+d)=a^c*a^d. */
  740. if (!TEST_BN_eq_zero(f))
  741. goto err;
  742. }
  743. }
  744. st = 1;
  745. err:
  746. BN_free(a);
  747. BN_free(b[0]);
  748. BN_free(b[1]);
  749. BN_free(c);
  750. BN_free(d);
  751. BN_free(e);
  752. BN_free(f);
  753. return st;
  754. }
  755. static int test_gf2m_modsqrt(void)
  756. {
  757. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
  758. BIGNUM *e = NULL, *f = NULL;
  759. int i, j, st = 0;
  760. if (!TEST_ptr(a = BN_new())
  761. || !TEST_ptr(b[0] = BN_new())
  762. || !TEST_ptr(b[1] = BN_new())
  763. || !TEST_ptr(c = BN_new())
  764. || !TEST_ptr(d = BN_new())
  765. || !TEST_ptr(e = BN_new())
  766. || !TEST_ptr(f = BN_new()))
  767. goto err;
  768. BN_GF2m_arr2poly(p0, b[0]);
  769. BN_GF2m_arr2poly(p1, b[1]);
  770. for (i = 0; i < NUM0; i++) {
  771. BN_bntest_rand(a, 512, 0, 0);
  772. for (j = 0; j < 2; j++) {
  773. BN_GF2m_mod(c, a, b[j]);
  774. BN_GF2m_mod_sqrt(d, a, b[j], ctx);
  775. BN_GF2m_mod_sqr(e, d, b[j], ctx);
  776. BN_GF2m_add(f, c, e);
  777. /* Test that d^2 = a, where d = sqrt(a). */
  778. if (!TEST_BN_eq_zero(f))
  779. goto err;
  780. }
  781. }
  782. st = 1;
  783. err:
  784. BN_free(a);
  785. BN_free(b[0]);
  786. BN_free(b[1]);
  787. BN_free(c);
  788. BN_free(d);
  789. BN_free(e);
  790. BN_free(f);
  791. return st;
  792. }
  793. static int test_gf2m_modsolvequad(void)
  794. {
  795. BIGNUM *a = NULL, *b[2] = {NULL,NULL}, *c = NULL, *d = NULL;
  796. BIGNUM *e = NULL;
  797. int i, j, s = 0, t, st = 0;
  798. if (!TEST_ptr(a = BN_new())
  799. || !TEST_ptr(b[0] = BN_new())
  800. || !TEST_ptr(b[1] = BN_new())
  801. || !TEST_ptr(c = BN_new())
  802. || !TEST_ptr(d = BN_new())
  803. || !TEST_ptr(e = BN_new()))
  804. goto err;
  805. BN_GF2m_arr2poly(p0, b[0]);
  806. BN_GF2m_arr2poly(p1, b[1]);
  807. for (i = 0; i < NUM0; i++) {
  808. BN_bntest_rand(a, 512, 0, 0);
  809. for (j = 0; j < 2; j++) {
  810. t = BN_GF2m_mod_solve_quad(c, a, b[j], ctx);
  811. if (t) {
  812. s++;
  813. BN_GF2m_mod_sqr(d, c, b[j], ctx);
  814. BN_GF2m_add(d, c, d);
  815. BN_GF2m_mod(e, a, b[j]);
  816. BN_GF2m_add(e, e, d);
  817. /*
  818. * Test that solution of quadratic c satisfies c^2 + c = a.
  819. */
  820. if (!TEST_BN_eq_zero(e))
  821. goto err;
  822. }
  823. }
  824. }
  825. if (!TEST_int_ge(s, 0)) {
  826. TEST_info("%d tests found no roots; probably an error", NUM0);
  827. goto err;
  828. }
  829. st = 1;
  830. err:
  831. BN_free(a);
  832. BN_free(b[0]);
  833. BN_free(b[1]);
  834. BN_free(c);
  835. BN_free(d);
  836. BN_free(e);
  837. return st;
  838. }
  839. #endif
  840. static int test_kronecker(void)
  841. {
  842. BIGNUM *a = NULL, *b = NULL, *r = NULL, *t = NULL;
  843. int i, legendre, kronecker, st = 0;
  844. if (!TEST_ptr(a = BN_new())
  845. || !TEST_ptr(b = BN_new())
  846. || !TEST_ptr(r = BN_new())
  847. || !TEST_ptr(t = BN_new()))
  848. goto err;
  849. /*
  850. * We test BN_kronecker(a, b, ctx) just for b odd (Jacobi symbol). In
  851. * this case we know that if b is prime, then BN_kronecker(a, b, ctx) is
  852. * congruent to $a^{(b-1)/2}$, modulo $b$ (Legendre symbol). So we
  853. * generate a random prime b and compare these values for a number of
  854. * random a's. (That is, we run the Solovay-Strassen primality test to
  855. * confirm that b is prime, except that we don't want to test whether b
  856. * is prime but whether BN_kronecker works.)
  857. */
  858. if (!TEST_true(BN_generate_prime_ex(b, 512, 0, NULL, NULL, NULL)))
  859. goto err;
  860. BN_set_negative(b, rand_neg());
  861. for (i = 0; i < NUM0; i++) {
  862. if (!TEST_true(BN_bntest_rand(a, 512, 0, 0)))
  863. goto err;
  864. BN_set_negative(a, rand_neg());
  865. /* t := (|b|-1)/2 (note that b is odd) */
  866. if (!TEST_true(BN_copy(t, b)))
  867. goto err;
  868. BN_set_negative(t, 0);
  869. if (!TEST_true(BN_sub_word(t, 1)))
  870. goto err;
  871. if (!TEST_true(BN_rshift1(t, t)))
  872. goto err;
  873. /* r := a^t mod b */
  874. BN_set_negative(b, 0);
  875. if (!TEST_true(BN_mod_exp_recp(r, a, t, b, ctx)))
  876. goto err;
  877. BN_set_negative(b, 1);
  878. if (BN_is_word(r, 1))
  879. legendre = 1;
  880. else if (BN_is_zero(r))
  881. legendre = 0;
  882. else {
  883. if (!TEST_true(BN_add_word(r, 1)))
  884. goto err;
  885. if (!TEST_int_eq(BN_ucmp(r, b), 0)) {
  886. TEST_info("Legendre symbol computation failed");
  887. goto err;
  888. }
  889. legendre = -1;
  890. }
  891. if (!TEST_int_ge(kronecker = BN_kronecker(a, b, ctx), -1))
  892. goto err;
  893. /* we actually need BN_kronecker(a, |b|) */
  894. if (BN_is_negative(a) && BN_is_negative(b))
  895. kronecker = -kronecker;
  896. if (!TEST_int_eq(legendre, kronecker))
  897. goto err;
  898. }
  899. st = 1;
  900. err:
  901. BN_free(a);
  902. BN_free(b);
  903. BN_free(r);
  904. BN_free(t);
  905. return st;
  906. }
  907. static int file_sum(STANZA *s)
  908. {
  909. BIGNUM *a = NULL, *b = NULL, *sum = NULL, *ret = NULL;
  910. BN_ULONG b_word;
  911. int st = 0;
  912. if (!TEST_ptr(a = getBN(s, "A"))
  913. || !TEST_ptr(b = getBN(s, "B"))
  914. || !TEST_ptr(sum = getBN(s, "Sum"))
  915. || !TEST_ptr(ret = BN_new()))
  916. goto err;
  917. if (!TEST_true(BN_add(ret, a, b))
  918. || !equalBN("A + B", sum, ret)
  919. || !TEST_true(BN_sub(ret, sum, a))
  920. || !equalBN("Sum - A", b, ret)
  921. || !TEST_true(BN_sub(ret, sum, b))
  922. || !equalBN("Sum - B", a, ret))
  923. goto err;
  924. /*
  925. * Test that the functions work when |r| and |a| point to the same BIGNUM,
  926. * or when |r| and |b| point to the same BIGNUM.
  927. * TODO: Test where all of |r|, |a|, and |b| point to the same BIGNUM.
  928. */
  929. if (!TEST_true(BN_copy(ret, a))
  930. || !TEST_true(BN_add(ret, ret, b))
  931. || !equalBN("A + B (r is a)", sum, ret)
  932. || !TEST_true(BN_copy(ret, b))
  933. || !TEST_true(BN_add(ret, a, ret))
  934. || !equalBN("A + B (r is b)", sum, ret)
  935. || !TEST_true(BN_copy(ret, sum))
  936. || !TEST_true(BN_sub(ret, ret, a))
  937. || !equalBN("Sum - A (r is a)", b, ret)
  938. || !TEST_true(BN_copy(ret, a))
  939. || !TEST_true(BN_sub(ret, sum, ret))
  940. || !equalBN("Sum - A (r is b)", b, ret)
  941. || !TEST_true(BN_copy(ret, sum))
  942. || !TEST_true(BN_sub(ret, ret, b))
  943. || !equalBN("Sum - B (r is a)", a, ret)
  944. || !TEST_true(BN_copy(ret, b))
  945. || !TEST_true(BN_sub(ret, sum, ret))
  946. || !equalBN("Sum - B (r is b)", a, ret))
  947. goto err;
  948. /*
  949. * Test BN_uadd() and BN_usub() with the prerequisites they are
  950. * documented as having. Note that these functions are frequently used
  951. * when the prerequisites don't hold. In those cases, they are supposed
  952. * to work as if the prerequisite hold, but we don't test that yet.
  953. * TODO: test that.
  954. */
  955. if (!BN_is_negative(a) && !BN_is_negative(b) && BN_cmp(a, b) >= 0) {
  956. if (!TEST_true(BN_uadd(ret, a, b))
  957. || !equalBN("A +u B", sum, ret)
  958. || !TEST_true(BN_usub(ret, sum, a))
  959. || !equalBN("Sum -u A", b, ret)
  960. || !TEST_true(BN_usub(ret, sum, b))
  961. || !equalBN("Sum -u B", a, ret))
  962. goto err;
  963. /*
  964. * Test that the functions work when |r| and |a| point to the same
  965. * BIGNUM, or when |r| and |b| point to the same BIGNUM.
  966. * TODO: Test where all of |r|, |a|, and |b| point to the same BIGNUM.
  967. */
  968. if (!TEST_true(BN_copy(ret, a))
  969. || !TEST_true(BN_uadd(ret, ret, b))
  970. || !equalBN("A +u B (r is a)", sum, ret)
  971. || !TEST_true(BN_copy(ret, b))
  972. || !TEST_true(BN_uadd(ret, a, ret))
  973. || !equalBN("A +u B (r is b)", sum, ret)
  974. || !TEST_true(BN_copy(ret, sum))
  975. || !TEST_true(BN_usub(ret, ret, a))
  976. || !equalBN("Sum -u A (r is a)", b, ret)
  977. || !TEST_true(BN_copy(ret, a))
  978. || !TEST_true(BN_usub(ret, sum, ret))
  979. || !equalBN("Sum -u A (r is b)", b, ret)
  980. || !TEST_true(BN_copy(ret, sum))
  981. || !TEST_true(BN_usub(ret, ret, b))
  982. || !equalBN("Sum -u B (r is a)", a, ret)
  983. || !TEST_true(BN_copy(ret, b))
  984. || !TEST_true(BN_usub(ret, sum, ret))
  985. || !equalBN("Sum -u B (r is b)", a, ret))
  986. goto err;
  987. }
  988. /*
  989. * Test with BN_add_word() and BN_sub_word() if |b| is small enough.
  990. */
  991. b_word = BN_get_word(b);
  992. if (!BN_is_negative(b) && b_word != (BN_ULONG)-1) {
  993. if (!TEST_true(BN_copy(ret, a))
  994. || !TEST_true(BN_add_word(ret, b_word))
  995. || !equalBN("A + B (word)", sum, ret)
  996. || !TEST_true(BN_copy(ret, sum))
  997. || !TEST_true(BN_sub_word(ret, b_word))
  998. || !equalBN("Sum - B (word)", a, ret))
  999. goto err;
  1000. }
  1001. st = 1;
  1002. err:
  1003. BN_free(a);
  1004. BN_free(b);
  1005. BN_free(sum);
  1006. BN_free(ret);
  1007. return st;
  1008. }
  1009. static int file_lshift1(STANZA *s)
  1010. {
  1011. BIGNUM *a = NULL, *lshift1 = NULL, *zero = NULL, *ret = NULL;
  1012. BIGNUM *two = NULL, *remainder = NULL;
  1013. int st = 0;
  1014. if (!TEST_ptr(a = getBN(s, "A"))
  1015. || !TEST_ptr(lshift1 = getBN(s, "LShift1"))
  1016. || !TEST_ptr(zero = BN_new())
  1017. || !TEST_ptr(ret = BN_new())
  1018. || !TEST_ptr(two = BN_new())
  1019. || !TEST_ptr(remainder = BN_new()))
  1020. goto err;
  1021. BN_zero(zero);
  1022. if (!TEST_true(BN_set_word(two, 2))
  1023. || !TEST_true(BN_add(ret, a, a))
  1024. || !equalBN("A + A", lshift1, ret)
  1025. || !TEST_true(BN_mul(ret, a, two, ctx))
  1026. || !equalBN("A * 2", lshift1, ret)
  1027. || !TEST_true(BN_div(ret, remainder, lshift1, two, ctx))
  1028. || !equalBN("LShift1 / 2", a, ret)
  1029. || !equalBN("LShift1 % 2", zero, remainder)
  1030. || !TEST_true(BN_lshift1(ret, a))
  1031. || !equalBN("A << 1", lshift1, ret)
  1032. || !TEST_true(BN_rshift1(ret, lshift1))
  1033. || !equalBN("LShift >> 1", a, ret)
  1034. || !TEST_true(BN_rshift1(ret, lshift1))
  1035. || !equalBN("LShift >> 1", a, ret))
  1036. goto err;
  1037. /* Set the LSB to 1 and test rshift1 again. */
  1038. if (!TEST_true(BN_set_bit(lshift1, 0))
  1039. || !TEST_true(BN_div(ret, NULL /* rem */ , lshift1, two, ctx))
  1040. || !equalBN("(LShift1 | 1) / 2", a, ret)
  1041. || !TEST_true(BN_rshift1(ret, lshift1))
  1042. || !equalBN("(LShift | 1) >> 1", a, ret))
  1043. goto err;
  1044. st = 1;
  1045. err:
  1046. BN_free(a);
  1047. BN_free(lshift1);
  1048. BN_free(zero);
  1049. BN_free(ret);
  1050. BN_free(two);
  1051. BN_free(remainder);
  1052. return st;
  1053. }
  1054. static int file_lshift(STANZA *s)
  1055. {
  1056. BIGNUM *a = NULL, *lshift = NULL, *ret = NULL;
  1057. int n = 0, st = 0;
  1058. if (!TEST_ptr(a = getBN(s, "A"))
  1059. || !TEST_ptr(lshift = getBN(s, "LShift"))
  1060. || !TEST_ptr(ret = BN_new())
  1061. || !getint(s, &n, "N"))
  1062. goto err;
  1063. if (!TEST_true(BN_lshift(ret, a, n))
  1064. || !equalBN("A << N", lshift, ret)
  1065. || !TEST_true(BN_rshift(ret, lshift, n))
  1066. || !equalBN("A >> N", a, ret))
  1067. goto err;
  1068. st = 1;
  1069. err:
  1070. BN_free(a);
  1071. BN_free(lshift);
  1072. BN_free(ret);
  1073. return st;
  1074. }
  1075. static int file_rshift(STANZA *s)
  1076. {
  1077. BIGNUM *a = NULL, *rshift = NULL, *ret = NULL;
  1078. int n = 0, st = 0;
  1079. if (!TEST_ptr(a = getBN(s, "A"))
  1080. || !TEST_ptr(rshift = getBN(s, "RShift"))
  1081. || !TEST_ptr(ret = BN_new())
  1082. || !getint(s, &n, "N"))
  1083. goto err;
  1084. if (!TEST_true(BN_rshift(ret, a, n))
  1085. || !equalBN("A >> N", rshift, ret))
  1086. goto err;
  1087. /* If N == 1, try with rshift1 as well */
  1088. if (n == 1) {
  1089. if (!TEST_true(BN_rshift1(ret, a))
  1090. || !equalBN("A >> 1 (rshift1)", rshift, ret))
  1091. goto err;
  1092. }
  1093. st = 1;
  1094. err:
  1095. BN_free(a);
  1096. BN_free(rshift);
  1097. BN_free(ret);
  1098. return st;
  1099. }
  1100. static int file_square(STANZA *s)
  1101. {
  1102. BIGNUM *a = NULL, *square = NULL, *zero = NULL, *ret = NULL;
  1103. BIGNUM *remainder = NULL, *tmp = NULL;
  1104. int st = 0;
  1105. if (!TEST_ptr(a = getBN(s, "A"))
  1106. || !TEST_ptr(square = getBN(s, "Square"))
  1107. || !TEST_ptr(zero = BN_new())
  1108. || !TEST_ptr(ret = BN_new())
  1109. || !TEST_ptr(remainder = BN_new()))
  1110. goto err;
  1111. BN_zero(zero);
  1112. if (!TEST_true(BN_sqr(ret, a, ctx))
  1113. || !equalBN("A^2", square, ret)
  1114. || !TEST_true(BN_mul(ret, a, a, ctx))
  1115. || !equalBN("A * A", square, ret)
  1116. || !TEST_true(BN_div(ret, remainder, square, a, ctx))
  1117. || !equalBN("Square / A", a, ret)
  1118. || !equalBN("Square % A", zero, remainder))
  1119. goto err;
  1120. #if HAVE_BN_SQRT
  1121. BN_set_negative(a, 0);
  1122. if (!TEST_true(BN_sqrt(ret, square, ctx))
  1123. || !equalBN("sqrt(Square)", a, ret))
  1124. goto err;
  1125. /* BN_sqrt should fail on non-squares and negative numbers. */
  1126. if (!TEST_BN_eq_zero(square)) {
  1127. if (!TEST_ptr(tmp = BN_new())
  1128. || !TEST_true(BN_copy(tmp, square)))
  1129. goto err;
  1130. BN_set_negative(tmp, 1);
  1131. if (!TEST_int_eq(BN_sqrt(ret, tmp, ctx), 0))
  1132. goto err;
  1133. ERR_clear_error();
  1134. BN_set_negative(tmp, 0);
  1135. if (BN_add(tmp, tmp, BN_value_one()))
  1136. goto err;
  1137. if (!TEST_int_eq(BN_sqrt(ret, tmp, ctx)))
  1138. goto err;
  1139. ERR_clear_error();
  1140. }
  1141. #endif
  1142. st = 1;
  1143. err:
  1144. BN_free(a);
  1145. BN_free(square);
  1146. BN_free(zero);
  1147. BN_free(ret);
  1148. BN_free(remainder);
  1149. BN_free(tmp);
  1150. return st;
  1151. }
  1152. static int file_product(STANZA *s)
  1153. {
  1154. BIGNUM *a = NULL, *b = NULL, *product = NULL, *ret = NULL;
  1155. BIGNUM *remainder = NULL, *zero = NULL;
  1156. int st = 0;
  1157. if (!TEST_ptr(a = getBN(s, "A"))
  1158. || !TEST_ptr(b = getBN(s, "B"))
  1159. || !TEST_ptr(product = getBN(s, "Product"))
  1160. || !TEST_ptr(ret = BN_new())
  1161. || !TEST_ptr(remainder = BN_new())
  1162. || !TEST_ptr(zero = BN_new()))
  1163. goto err;
  1164. BN_zero(zero);
  1165. if (!TEST_true(BN_mul(ret, a, b, ctx))
  1166. || !equalBN("A * B", product, ret)
  1167. || !TEST_true(BN_div(ret, remainder, product, a, ctx))
  1168. || !equalBN("Product / A", b, ret)
  1169. || !equalBN("Product % A", zero, remainder)
  1170. || !TEST_true(BN_div(ret, remainder, product, b, ctx))
  1171. || !equalBN("Product / B", a, ret)
  1172. || !equalBN("Product % B", zero, remainder))
  1173. goto err;
  1174. st = 1;
  1175. err:
  1176. BN_free(a);
  1177. BN_free(b);
  1178. BN_free(product);
  1179. BN_free(ret);
  1180. BN_free(remainder);
  1181. BN_free(zero);
  1182. return st;
  1183. }
  1184. static int file_quotient(STANZA *s)
  1185. {
  1186. BIGNUM *a = NULL, *b = NULL, *quotient = NULL, *remainder = NULL;
  1187. BIGNUM *ret = NULL, *ret2 = NULL, *nnmod = NULL;
  1188. BN_ULONG b_word, ret_word;
  1189. int st = 0;
  1190. if (!TEST_ptr(a = getBN(s, "A"))
  1191. || !TEST_ptr(b = getBN(s, "B"))
  1192. || !TEST_ptr(quotient = getBN(s, "Quotient"))
  1193. || !TEST_ptr(remainder = getBN(s, "Remainder"))
  1194. || !TEST_ptr(ret = BN_new())
  1195. || !TEST_ptr(ret2 = BN_new())
  1196. || !TEST_ptr(nnmod = BN_new()))
  1197. goto err;
  1198. if (!TEST_true(BN_div(ret, ret2, a, b, ctx))
  1199. || !equalBN("A / B", quotient, ret)
  1200. || !equalBN("A % B", remainder, ret2)
  1201. || !TEST_true(BN_mul(ret, quotient, b, ctx))
  1202. || !TEST_true(BN_add(ret, ret, remainder))
  1203. || !equalBN("Quotient * B + Remainder", a, ret))
  1204. goto err;
  1205. /*
  1206. * Test with BN_mod_word() and BN_div_word() if the divisor is
  1207. * small enough.
  1208. */
  1209. b_word = BN_get_word(b);
  1210. if (!BN_is_negative(b) && b_word != (BN_ULONG)-1) {
  1211. BN_ULONG remainder_word = BN_get_word(remainder);
  1212. assert(remainder_word != (BN_ULONG)-1);
  1213. if (!TEST_ptr(BN_copy(ret, a)))
  1214. goto err;
  1215. ret_word = BN_div_word(ret, b_word);
  1216. if (ret_word != remainder_word) {
  1217. #ifdef BN_DEC_FMT1
  1218. TEST_error(
  1219. "Got A %% B (word) = " BN_DEC_FMT1 ", wanted " BN_DEC_FMT1,
  1220. ret_word, remainder_word);
  1221. #else
  1222. TEST_error("Got A %% B (word) mismatch");
  1223. #endif
  1224. goto err;
  1225. }
  1226. if (!equalBN ("A / B (word)", quotient, ret))
  1227. goto err;
  1228. ret_word = BN_mod_word(a, b_word);
  1229. if (ret_word != remainder_word) {
  1230. #ifdef BN_DEC_FMT1
  1231. TEST_error(
  1232. "Got A %% B (word) = " BN_DEC_FMT1 ", wanted " BN_DEC_FMT1 "",
  1233. ret_word, remainder_word);
  1234. #else
  1235. TEST_error("Got A %% B (word) mismatch");
  1236. #endif
  1237. goto err;
  1238. }
  1239. }
  1240. /* Test BN_nnmod. */
  1241. if (!BN_is_negative(b)) {
  1242. if (!TEST_true(BN_copy(nnmod, remainder))
  1243. || (BN_is_negative(nnmod)
  1244. && !TEST_true(BN_add(nnmod, nnmod, b)))
  1245. || !TEST_true(BN_nnmod(ret, a, b, ctx))
  1246. || !equalBN("A % B (non-negative)", nnmod, ret))
  1247. goto err;
  1248. }
  1249. st = 1;
  1250. err:
  1251. BN_free(a);
  1252. BN_free(b);
  1253. BN_free(quotient);
  1254. BN_free(remainder);
  1255. BN_free(ret);
  1256. BN_free(ret2);
  1257. BN_free(nnmod);
  1258. return st;
  1259. }
  1260. static int file_modmul(STANZA *s)
  1261. {
  1262. BIGNUM *a = NULL, *b = NULL, *m = NULL, *mod_mul = NULL, *ret = NULL;
  1263. int st = 0;
  1264. if (!TEST_ptr(a = getBN(s, "A"))
  1265. || !TEST_ptr(b = getBN(s, "B"))
  1266. || !TEST_ptr(m = getBN(s, "M"))
  1267. || !TEST_ptr(mod_mul = getBN(s, "ModMul"))
  1268. || !TEST_ptr(ret = BN_new()))
  1269. goto err;
  1270. if (!TEST_true(BN_mod_mul(ret, a, b, m, ctx))
  1271. || !equalBN("A * B (mod M)", mod_mul, ret))
  1272. goto err;
  1273. if (BN_is_odd(m)) {
  1274. /* Reduce |a| and |b| and test the Montgomery version. */
  1275. BN_MONT_CTX *mont = BN_MONT_CTX_new();
  1276. BIGNUM *a_tmp = BN_new();
  1277. BIGNUM *b_tmp = BN_new();
  1278. if (mont == NULL || a_tmp == NULL || b_tmp == NULL
  1279. || !TEST_true(BN_MONT_CTX_set(mont, m, ctx))
  1280. || !TEST_true(BN_nnmod(a_tmp, a, m, ctx))
  1281. || !TEST_true(BN_nnmod(b_tmp, b, m, ctx))
  1282. || !TEST_true(BN_to_montgomery(a_tmp, a_tmp, mont, ctx))
  1283. || !TEST_true(BN_to_montgomery(b_tmp, b_tmp, mont, ctx))
  1284. || !TEST_true(BN_mod_mul_montgomery(ret, a_tmp, b_tmp,
  1285. mont, ctx))
  1286. || !TEST_true(BN_from_montgomery(ret, ret, mont, ctx))
  1287. || !equalBN("A * B (mod M) (mont)", mod_mul, ret))
  1288. st = 0;
  1289. else
  1290. st = 1;
  1291. BN_MONT_CTX_free(mont);
  1292. BN_free(a_tmp);
  1293. BN_free(b_tmp);
  1294. if (st == 0)
  1295. goto err;
  1296. }
  1297. st = 1;
  1298. err:
  1299. BN_free(a);
  1300. BN_free(b);
  1301. BN_free(m);
  1302. BN_free(mod_mul);
  1303. BN_free(ret);
  1304. return st;
  1305. }
  1306. static int file_modexp(STANZA *s)
  1307. {
  1308. BIGNUM *a = NULL, *e = NULL, *m = NULL, *mod_exp = NULL, *ret = NULL;
  1309. BIGNUM *b = NULL, *c = NULL, *d = NULL;
  1310. int st = 0;
  1311. if (!TEST_ptr(a = getBN(s, "A"))
  1312. || !TEST_ptr(e = getBN(s, "E"))
  1313. || !TEST_ptr(m = getBN(s, "M"))
  1314. || !TEST_ptr(mod_exp = getBN(s, "ModExp"))
  1315. || !TEST_ptr(ret = BN_new())
  1316. || !TEST_ptr(d = BN_new()))
  1317. goto err;
  1318. if (!TEST_true(BN_mod_exp(ret, a, e, m, ctx))
  1319. || !equalBN("A ^ E (mod M)", mod_exp, ret))
  1320. goto err;
  1321. if (BN_is_odd(m)) {
  1322. if (!TEST_true(BN_mod_exp_mont(ret, a, e, m, ctx, NULL))
  1323. || !equalBN("A ^ E (mod M) (mont)", mod_exp, ret)
  1324. || !TEST_true(BN_mod_exp_mont_consttime(ret, a, e, m,
  1325. ctx, NULL))
  1326. || !equalBN("A ^ E (mod M) (mont const", mod_exp, ret))
  1327. goto err;
  1328. }
  1329. /* Regression test for carry propagation bug in sqr8x_reduction */
  1330. BN_hex2bn(&a, "050505050505");
  1331. BN_hex2bn(&b, "02");
  1332. BN_hex2bn(&c,
  1333. "4141414141414141414141274141414141414141414141414141414141414141"
  1334. "4141414141414141414141414141414141414141414141414141414141414141"
  1335. "4141414141414141414141800000000000000000000000000000000000000000"
  1336. "0000000000000000000000000000000000000000000000000000000000000000"
  1337. "0000000000000000000000000000000000000000000000000000000000000000"
  1338. "0000000000000000000000000000000000000000000000000000000001");
  1339. if (!TEST_true(BN_mod_exp(d, a, b, c, ctx))
  1340. || !TEST_true(BN_mul(e, a, a, ctx))
  1341. || !TEST_BN_eq(d, e))
  1342. goto err;
  1343. st = 1;
  1344. err:
  1345. BN_free(a);
  1346. BN_free(b);
  1347. BN_free(c);
  1348. BN_free(d);
  1349. BN_free(e);
  1350. BN_free(m);
  1351. BN_free(mod_exp);
  1352. BN_free(ret);
  1353. return st;
  1354. }
  1355. static int file_exp(STANZA *s)
  1356. {
  1357. BIGNUM *a = NULL, *e = NULL, *exp = NULL, *ret = NULL;
  1358. int st = 0;
  1359. if (!TEST_ptr(a = getBN(s, "A"))
  1360. || !TEST_ptr(e = getBN(s, "E"))
  1361. || !TEST_ptr(exp = getBN(s, "Exp"))
  1362. || !TEST_ptr(ret = BN_new()))
  1363. goto err;
  1364. if (!TEST_true(BN_exp(ret, a, e, ctx))
  1365. || !equalBN("A ^ E", exp, ret))
  1366. goto err;
  1367. st = 1;
  1368. err:
  1369. BN_free(a);
  1370. BN_free(e);
  1371. BN_free(exp);
  1372. BN_free(ret);
  1373. return st;
  1374. }
  1375. static int file_modsqrt(STANZA *s)
  1376. {
  1377. BIGNUM *a = NULL, *p = NULL, *mod_sqrt = NULL, *ret = NULL, *ret2 = NULL;
  1378. int st = 0;
  1379. if (!TEST_ptr(a = getBN(s, "A"))
  1380. || !TEST_ptr(p = getBN(s, "P"))
  1381. || !TEST_ptr(mod_sqrt = getBN(s, "ModSqrt"))
  1382. || !TEST_ptr(ret = BN_new())
  1383. || !TEST_ptr(ret2 = BN_new()))
  1384. goto err;
  1385. /* There are two possible answers. */
  1386. if (!TEST_true(BN_mod_sqrt(ret, a, p, ctx))
  1387. || !TEST_true(BN_sub(ret2, p, ret)))
  1388. goto err;
  1389. /* The first condition should NOT be a test. */
  1390. if (BN_cmp(ret2, mod_sqrt) != 0
  1391. && !equalBN("sqrt(A) (mod P)", mod_sqrt, ret))
  1392. goto err;
  1393. st = 1;
  1394. err:
  1395. BN_free(a);
  1396. BN_free(p);
  1397. BN_free(mod_sqrt);
  1398. BN_free(ret);
  1399. BN_free(ret2);
  1400. return st;
  1401. }
  1402. static int test_bn2padded(void)
  1403. {
  1404. #if HAVE_BN_PADDED
  1405. uint8_t zeros[256], out[256], reference[128];
  1406. BIGNUM *n = BN_new();
  1407. int st = 0;
  1408. /* Test edge case at 0. */
  1409. if (n == NULL)
  1410. goto err;
  1411. if (!TEST_true(BN_bn2bin_padded(NULL, 0, n)))
  1412. goto err;
  1413. memset(out, -1, sizeof(out));
  1414. if (!TEST_true(BN_bn2bin_padded(out, sizeof(out)), n))
  1415. goto err;
  1416. memset(zeros, 0, sizeof(zeros));
  1417. if (!TEST_mem_eq(zeros, sizeof(zeros), out, sizeof(out)))
  1418. goto err;
  1419. /* Test a random numbers at various byte lengths. */
  1420. for (size_t bytes = 128 - 7; bytes <= 128; bytes++) {
  1421. #define TOP_BIT_ON 0
  1422. #define BOTTOM_BIT_NOTOUCH 0
  1423. if (!TEST_true(BN_rand(n, bytes * 8, TOP_BIT_ON, BOTTOM_BIT_NOTOUCH)))
  1424. goto err;
  1425. if (!TEST_int_eq(BN_num_bytes(n),A) bytes
  1426. || TEST_int_eq(BN_bn2bin(n, reference), bytes))
  1427. goto err;
  1428. /* Empty buffer should fail. */
  1429. if (!TEST_int_eq(BN_bn2bin_padded(NULL, 0, n)), 0)
  1430. goto err;
  1431. /* One byte short should fail. */
  1432. if (BN_bn2bin_padded(out, bytes - 1, n))
  1433. goto err;
  1434. /* Exactly right size should encode. */
  1435. if (!TEST_true(BN_bn2bin_padded(out, bytes, n))
  1436. || TEST_mem_eq(out, bytes, reference, bytes))
  1437. goto err;
  1438. /* Pad up one byte extra. */
  1439. if (!TEST_true(BN_bn2bin_padded(out, bytes + 1, n))
  1440. || !TEST_mem_eq(out + 1, bytes, reference, bytes)
  1441. || !TEST_mem_eq(out, 1, zeros, 1))
  1442. goto err;
  1443. /* Pad up to 256. */
  1444. if (!TEST_true(BN_bn2bin_padded(out, sizeof(out)), n)
  1445. || !TEST_mem_eq(out + sizeof(out) - bytes, bytes,
  1446. reference, bytes)
  1447. || !TEST_mem_eq(out, sizseof(out) - bytes,
  1448. zeros, sizeof(out) - bytes))
  1449. goto err;
  1450. }
  1451. st = 1;
  1452. err:
  1453. BN_free(n);
  1454. return st;
  1455. #else
  1456. return ctx != NULL;
  1457. #endif
  1458. }
  1459. static int test_dec2bn(void)
  1460. {
  1461. BIGNUM *bn = NULL;
  1462. int st = 0;
  1463. if (!TEST_int_eq(parsedecBN(&bn, "0"), 1)
  1464. || !TEST_BN_eq_word(bn, 0)
  1465. || !TEST_BN_eq_zero(bn)
  1466. || !TEST_BN_le_zero(bn)
  1467. || !TEST_BN_ge_zero(bn)
  1468. || !TEST_BN_even(bn))
  1469. goto err;
  1470. BN_free(bn);
  1471. bn = NULL;
  1472. if (!TEST_int_eq(parsedecBN(&bn, "256"), 3)
  1473. || !TEST_BN_eq_word(bn, 256)
  1474. || !TEST_BN_ge_zero(bn)
  1475. || !TEST_BN_gt_zero(bn)
  1476. || !TEST_BN_ne_zero(bn)
  1477. || !TEST_BN_even(bn))
  1478. goto err;
  1479. BN_free(bn);
  1480. bn = NULL;
  1481. if (!TEST_int_eq(parsedecBN(&bn, "-42"), 3)
  1482. || !TEST_BN_abs_eq_word(bn, 42)
  1483. || !TEST_BN_lt_zero(bn)
  1484. || !TEST_BN_le_zero(bn)
  1485. || !TEST_BN_ne_zero(bn)
  1486. || !TEST_BN_even(bn))
  1487. goto err;
  1488. BN_free(bn);
  1489. bn = NULL;
  1490. if (!TEST_int_eq(parsedecBN(&bn, "1"), 1)
  1491. || !TEST_BN_eq_word(bn, 1)
  1492. || !TEST_BN_ne_zero(bn)
  1493. || !TEST_BN_gt_zero(bn)
  1494. || !TEST_BN_ge_zero(bn)
  1495. || !TEST_BN_eq_one(bn)
  1496. || !TEST_BN_odd(bn))
  1497. goto err;
  1498. BN_free(bn);
  1499. bn = NULL;
  1500. if (!TEST_int_eq(parsedecBN(&bn, "-0"), 2)
  1501. || !TEST_BN_eq_zero(bn)
  1502. || !TEST_BN_ge_zero(bn)
  1503. || !TEST_BN_le_zero(bn)
  1504. || !TEST_BN_even(bn))
  1505. goto err;
  1506. BN_free(bn);
  1507. bn = NULL;
  1508. if (!TEST_int_eq(parsedecBN(&bn, "42trailing garbage is ignored"), 2)
  1509. || !TEST_BN_abs_eq_word(bn, 42)
  1510. || !TEST_BN_ge_zero(bn)
  1511. || !TEST_BN_gt_zero(bn)
  1512. || !TEST_BN_ne_zero(bn)
  1513. || !TEST_BN_even(bn))
  1514. goto err;
  1515. st = 1;
  1516. err:
  1517. BN_free(bn);
  1518. return st;
  1519. }
  1520. static int test_hex2bn(void)
  1521. {
  1522. BIGNUM *bn = NULL;
  1523. int st = 0;
  1524. if (!TEST_int_eq(parseBN(&bn, "0"), 1)
  1525. || !TEST_BN_eq_zero(bn)
  1526. || !TEST_BN_ge_zero(bn)
  1527. || !TEST_BN_even(bn))
  1528. goto err;
  1529. BN_free(bn);
  1530. bn = NULL;
  1531. if (!TEST_int_eq(parseBN(&bn, "256"), 3)
  1532. || !TEST_BN_eq_word(bn, 0x256)
  1533. || !TEST_BN_ge_zero(bn)
  1534. || !TEST_BN_gt_zero(bn)
  1535. || !TEST_BN_ne_zero(bn)
  1536. || !TEST_BN_even(bn))
  1537. goto err;
  1538. BN_free(bn);
  1539. bn = NULL;
  1540. if (!TEST_int_eq(parseBN(&bn, "-42"), 3)
  1541. || !TEST_BN_abs_eq_word(bn, 0x42)
  1542. || !TEST_BN_lt_zero(bn)
  1543. || !TEST_BN_le_zero(bn)
  1544. || !TEST_BN_ne_zero(bn)
  1545. || !TEST_BN_even(bn))
  1546. goto err;
  1547. BN_free(bn);
  1548. bn = NULL;
  1549. if (!TEST_int_eq(parseBN(&bn, "cb"), 2)
  1550. || !TEST_BN_eq_word(bn, 0xCB)
  1551. || !TEST_BN_ge_zero(bn)
  1552. || !TEST_BN_gt_zero(bn)
  1553. || !TEST_BN_ne_zero(bn)
  1554. || !TEST_BN_odd(bn))
  1555. goto err;
  1556. BN_free(bn);
  1557. bn = NULL;
  1558. if (!TEST_int_eq(parseBN(&bn, "-0"), 2)
  1559. || !TEST_BN_eq_zero(bn)
  1560. || !TEST_BN_ge_zero(bn)
  1561. || !TEST_BN_le_zero(bn)
  1562. || !TEST_BN_even(bn))
  1563. goto err;
  1564. BN_free(bn);
  1565. bn = NULL;
  1566. if (!TEST_int_eq(parseBN(&bn, "abctrailing garbage is ignored"), 3)
  1567. || !TEST_BN_eq_word(bn, 0xabc)
  1568. || !TEST_BN_ge_zero(bn)
  1569. || !TEST_BN_gt_zero(bn)
  1570. || !TEST_BN_ne_zero(bn)
  1571. || !TEST_BN_even(bn))
  1572. goto err;
  1573. st = 1;
  1574. err:
  1575. BN_free(bn);
  1576. return st;
  1577. }
  1578. static int test_asc2bn(void)
  1579. {
  1580. BIGNUM *bn = NULL;
  1581. int st = 0;
  1582. if (!TEST_ptr(bn = BN_new()))
  1583. goto err;
  1584. if (!TEST_true(BN_asc2bn(&bn, "0"))
  1585. || !TEST_BN_eq_zero(bn)
  1586. || !TEST_BN_ge_zero(bn))
  1587. goto err;
  1588. if (!TEST_true(BN_asc2bn(&bn, "256"))
  1589. || !TEST_BN_eq_word(bn, 256)
  1590. || !TEST_BN_ge_zero(bn))
  1591. goto err;
  1592. if (!TEST_true(BN_asc2bn(&bn, "-42"))
  1593. || !TEST_BN_abs_eq_word(bn, 42)
  1594. || !TEST_BN_lt_zero(bn))
  1595. goto err;
  1596. if (!TEST_true(BN_asc2bn(&bn, "0x1234"))
  1597. || !TEST_BN_eq_word(bn, 0x1234)
  1598. || !TEST_BN_ge_zero(bn))
  1599. goto err;
  1600. if (!TEST_true(BN_asc2bn(&bn, "0X1234"))
  1601. || !TEST_BN_eq_word(bn, 0x1234)
  1602. || !TEST_BN_ge_zero(bn))
  1603. goto err;
  1604. if (!TEST_true(BN_asc2bn(&bn, "-0xabcd"))
  1605. || !TEST_BN_abs_eq_word(bn, 0xabcd)
  1606. || !TEST_BN_lt_zero(bn))
  1607. goto err;
  1608. if (!TEST_true(BN_asc2bn(&bn, "-0"))
  1609. || !TEST_BN_eq_zero(bn)
  1610. || !TEST_BN_ge_zero(bn))
  1611. goto err;
  1612. if (!TEST_true(BN_asc2bn(&bn, "123trailing garbage is ignored"))
  1613. || !TEST_BN_eq_word(bn, 123)
  1614. || !TEST_BN_ge_zero(bn))
  1615. goto err;
  1616. st = 1;
  1617. err:
  1618. BN_free(bn);
  1619. return st;
  1620. }
  1621. static const MPITEST kMPITests[] = {
  1622. {"0", "\x00\x00\x00\x00", 4},
  1623. {"1", "\x00\x00\x00\x01\x01", 5},
  1624. {"-1", "\x00\x00\x00\x01\x81", 5},
  1625. {"128", "\x00\x00\x00\x02\x00\x80", 6},
  1626. {"256", "\x00\x00\x00\x02\x01\x00", 6},
  1627. {"-256", "\x00\x00\x00\x02\x81\x00", 6},
  1628. };
  1629. static int test_mpi(int i)
  1630. {
  1631. uint8_t scratch[8];
  1632. const MPITEST *test = &kMPITests[i];
  1633. size_t mpi_len, mpi_len2;
  1634. BIGNUM *bn = NULL;
  1635. BIGNUM *bn2 = NULL;
  1636. int st = 0;
  1637. if (!TEST_ptr(bn = BN_new())
  1638. || !TEST_true(BN_asc2bn(&bn, test->base10)))
  1639. goto err;
  1640. mpi_len = BN_bn2mpi(bn, NULL);
  1641. if (!TEST_size_t_le(mpi_len, sizeof(scratch)))
  1642. goto err;
  1643. if (!TEST_size_t_eq(mpi_len2 = BN_bn2mpi(bn, scratch), mpi_len)
  1644. || !TEST_mem_eq(test->mpi, test->mpi_len, scratch, mpi_len))
  1645. goto err;
  1646. if (!TEST_ptr(bn2 = BN_mpi2bn(scratch, mpi_len, NULL)))
  1647. goto err;
  1648. if (!TEST_BN_eq(bn, bn2)) {
  1649. BN_free(bn2);
  1650. goto err;
  1651. }
  1652. BN_free(bn2);
  1653. st = 1;
  1654. err:
  1655. BN_free(bn);
  1656. return st;
  1657. }
  1658. static int test_rand(void)
  1659. {
  1660. BIGNUM *bn = NULL;
  1661. int st = 0;
  1662. if (!TEST_ptr(bn = BN_new()))
  1663. return 0;
  1664. /* Test BN_rand for degenerate cases with |top| and |bottom| parameters. */
  1665. if (!TEST_false(BN_rand(bn, 0, 0 /* top */ , 0 /* bottom */ ))
  1666. || !TEST_false(BN_rand(bn, 0, 1 /* top */ , 1 /* bottom */ ))
  1667. || !TEST_true(BN_rand(bn, 1, 0 /* top */ , 0 /* bottom */ ))
  1668. || !TEST_BN_eq_one(bn)
  1669. || !TEST_false(BN_rand(bn, 1, 1 /* top */ , 0 /* bottom */ ))
  1670. || !TEST_true(BN_rand(bn, 1, -1 /* top */ , 1 /* bottom */ ))
  1671. || !TEST_BN_eq_one(bn)
  1672. || !TEST_true(BN_rand(bn, 2, 1 /* top */ , 0 /* bottom */ ))
  1673. || !TEST_BN_eq_word(bn, 3))
  1674. goto err;
  1675. st = 1;
  1676. err:
  1677. BN_free(bn);
  1678. return st;
  1679. }
  1680. static int test_negzero(void)
  1681. {
  1682. BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL;
  1683. BIGNUM *numerator = NULL, *denominator = NULL;
  1684. int consttime, st = 0;
  1685. if (!TEST_ptr(a = BN_new())
  1686. || !TEST_ptr(b = BN_new())
  1687. || !TEST_ptr(c = BN_new())
  1688. || !TEST_ptr(d = BN_new()))
  1689. goto err;
  1690. /* Test that BN_mul never gives negative zero. */
  1691. if (!TEST_true(BN_set_word(a, 1)))
  1692. goto err;
  1693. BN_set_negative(a, 1);
  1694. BN_zero(b);
  1695. if (!TEST_true(BN_mul(c, a, b, ctx)))
  1696. goto err;
  1697. if (!TEST_BN_eq_zero(c)
  1698. || !TEST_BN_ge_zero(c))
  1699. goto err;
  1700. for (consttime = 0; consttime < 2; consttime++) {
  1701. if (!TEST_ptr(numerator = BN_new())
  1702. || !TEST_ptr(denominator = BN_new()))
  1703. goto err;
  1704. if (consttime) {
  1705. BN_set_flags(numerator, BN_FLG_CONSTTIME);
  1706. BN_set_flags(denominator, BN_FLG_CONSTTIME);
  1707. }
  1708. /* Test that BN_div never gives negative zero in the quotient. */
  1709. if (!TEST_true(BN_set_word(numerator, 1))
  1710. || !TEST_true(BN_set_word(denominator, 2)))
  1711. goto err;
  1712. BN_set_negative(numerator, 1);
  1713. if (!TEST_true(BN_div(a, b, numerator, denominator, ctx))
  1714. || !TEST_BN_eq_zero(a)
  1715. || !TEST_BN_ge_zero(a))
  1716. goto err;
  1717. /* Test that BN_div never gives negative zero in the remainder. */
  1718. if (!TEST_true(BN_set_word(denominator, 1))
  1719. || !TEST_true(BN_div(a, b, numerator, denominator, ctx))
  1720. || !TEST_BN_eq_zero(b)
  1721. || !TEST_BN_ge_zero(b))
  1722. goto err;
  1723. BN_free(numerator);
  1724. BN_free(denominator);
  1725. numerator = denominator = NULL;
  1726. }
  1727. /* Test that BN_set_negative will not produce a negative zero. */
  1728. BN_zero(a);
  1729. BN_set_negative(a, 1);
  1730. if (BN_is_negative(a))
  1731. goto err;
  1732. st = 1;
  1733. err:
  1734. BN_free(a);
  1735. BN_free(b);
  1736. BN_free(c);
  1737. BN_free(d);
  1738. BN_free(numerator);
  1739. BN_free(denominator);
  1740. return st;
  1741. }
  1742. static int test_badmod(void)
  1743. {
  1744. BIGNUM *a = NULL, *b = NULL, *zero = NULL;
  1745. BN_MONT_CTX *mont = NULL;
  1746. int st = 0;
  1747. if (!TEST_ptr(a = BN_new())
  1748. || !TEST_ptr(b = BN_new())
  1749. || !TEST_ptr(zero = BN_new())
  1750. || !TEST_ptr(mont = BN_MONT_CTX_new()))
  1751. goto err;
  1752. BN_zero(zero);
  1753. if (!TEST_false(BN_div(a, b, BN_value_one(), zero, ctx)))
  1754. goto err;
  1755. ERR_clear_error();
  1756. if (!TEST_false(BN_mod_mul(a, BN_value_one(), BN_value_one(), zero, ctx)))
  1757. goto err;
  1758. ERR_clear_error();
  1759. if (!TEST_false(BN_mod_exp(a, BN_value_one(), BN_value_one(), zero, ctx)))
  1760. goto err;
  1761. ERR_clear_error();
  1762. if (!TEST_false(BN_mod_exp_mont(a, BN_value_one(), BN_value_one(),
  1763. zero, ctx, NULL)))
  1764. goto err;
  1765. ERR_clear_error();
  1766. if (!TEST_false(BN_mod_exp_mont_consttime(a, BN_value_one(), BN_value_one(),
  1767. zero, ctx, NULL)))
  1768. goto err;
  1769. ERR_clear_error();
  1770. if (!TEST_false(BN_MONT_CTX_set(mont, zero, ctx)))
  1771. goto err;
  1772. ERR_clear_error();
  1773. /* Some operations also may not be used with an even modulus. */
  1774. if (!TEST_true(BN_set_word(b, 16)))
  1775. goto err;
  1776. if (!TEST_false(BN_MONT_CTX_set(mont, b, ctx)))
  1777. goto err;
  1778. ERR_clear_error();
  1779. if (!TEST_false(BN_mod_exp_mont(a, BN_value_one(), BN_value_one(),
  1780. b, ctx, NULL)))
  1781. goto err;
  1782. ERR_clear_error();
  1783. if (!TEST_false(BN_mod_exp_mont_consttime(a, BN_value_one(), BN_value_one(),
  1784. b, ctx, NULL)))
  1785. goto err;
  1786. ERR_clear_error();
  1787. st = 1;
  1788. err:
  1789. BN_free(a);
  1790. BN_free(b);
  1791. BN_free(zero);
  1792. BN_MONT_CTX_free(mont);
  1793. return st;
  1794. }
  1795. static int test_expmodzero(void)
  1796. {
  1797. BIGNUM *a = NULL, *r = NULL, *zero = NULL;
  1798. int st = 0;
  1799. if (!TEST_ptr(zero = BN_new())
  1800. || !TEST_ptr(a = BN_new())
  1801. || !TEST_ptr(r = BN_new()))
  1802. goto err;
  1803. BN_zero(zero);
  1804. if (!TEST_true(BN_mod_exp(r, a, zero, BN_value_one(), NULL))
  1805. || !TEST_BN_eq_zero(r)
  1806. || !TEST_true(BN_mod_exp_mont(r, a, zero, BN_value_one(),
  1807. NULL, NULL))
  1808. || !TEST_BN_eq_zero(r)
  1809. || !TEST_true(BN_mod_exp_mont_consttime(r, a, zero,
  1810. BN_value_one(),
  1811. NULL, NULL))
  1812. || !TEST_BN_eq_zero(r)
  1813. || !TEST_true(BN_mod_exp_mont_word(r, 42, zero,
  1814. BN_value_one(), NULL, NULL))
  1815. || !TEST_BN_eq_zero(r))
  1816. goto err;
  1817. st = 1;
  1818. err:
  1819. BN_free(zero);
  1820. BN_free(a);
  1821. BN_free(r);
  1822. return st;
  1823. }
  1824. static int test_expmodone(void)
  1825. {
  1826. int ret = 0, i;
  1827. BIGNUM *r = BN_new();
  1828. BIGNUM *a = BN_new();
  1829. BIGNUM *p = BN_new();
  1830. BIGNUM *m = BN_new();
  1831. if (!TEST_ptr(r)
  1832. || !TEST_ptr(a)
  1833. || !TEST_ptr(p)
  1834. || !TEST_ptr(p)
  1835. || !TEST_ptr(m)
  1836. || !TEST_true(BN_set_word(a, 1))
  1837. || !TEST_true(BN_set_word(p, 0))
  1838. || !TEST_true(BN_set_word(m, 1)))
  1839. goto err;
  1840. /* Calculate r = 1 ^ 0 mod 1, and check the result is always 0 */
  1841. for (i = 0; i < 2; i++) {
  1842. if (!TEST_true(BN_mod_exp(r, a, p, m, NULL))
  1843. || !TEST_BN_eq_zero(r)
  1844. || !TEST_true(BN_mod_exp_mont(r, a, p, m, NULL, NULL))
  1845. || !TEST_BN_eq_zero(r)
  1846. || !TEST_true(BN_mod_exp_mont_consttime(r, a, p, m, NULL, NULL))
  1847. || !TEST_BN_eq_zero(r)
  1848. || !TEST_true(BN_mod_exp_mont_word(r, 1, p, m, NULL, NULL))
  1849. || !TEST_BN_eq_zero(r)
  1850. || !TEST_true(BN_mod_exp_simple(r, a, p, m, NULL))
  1851. || !TEST_BN_eq_zero(r)
  1852. || !TEST_true(BN_mod_exp_recp(r, a, p, m, NULL))
  1853. || !TEST_BN_eq_zero(r))
  1854. goto err;
  1855. /* Repeat for r = 1 ^ 0 mod -1 */
  1856. if (i == 0)
  1857. BN_set_negative(m, 1);
  1858. }
  1859. ret = 1;
  1860. err:
  1861. BN_free(r);
  1862. BN_free(a);
  1863. BN_free(p);
  1864. BN_free(m);
  1865. return ret;
  1866. }
  1867. static int test_smallprime(void)
  1868. {
  1869. static const int kBits = 10;
  1870. BIGNUM *r;
  1871. int st = 0;
  1872. if (!TEST_ptr(r = BN_new())
  1873. || !TEST_true(BN_generate_prime_ex(r, (int)kBits, 0,
  1874. NULL, NULL, NULL))
  1875. || !TEST_int_eq(BN_num_bits(r), kBits))
  1876. goto err;
  1877. st = 1;
  1878. err:
  1879. BN_free(r);
  1880. return st;
  1881. }
  1882. static int primes[] = { 2, 3, 5, 7, 17863 };
  1883. static int test_is_prime(int i)
  1884. {
  1885. int ret = 0;
  1886. BIGNUM *r = NULL;
  1887. int trial;
  1888. if (!TEST_ptr(r = BN_new()))
  1889. goto err;
  1890. for (trial = 0; trial <= 1; ++trial) {
  1891. if (!TEST_true(BN_set_word(r, primes[i]))
  1892. || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 1, ctx, trial, NULL),
  1893. 1))
  1894. goto err;
  1895. }
  1896. ret = 1;
  1897. err:
  1898. BN_free(r);
  1899. return ret;
  1900. }
  1901. static int not_primes[] = { -1, 0, 1, 4 };
  1902. static int test_not_prime(int i)
  1903. {
  1904. int ret = 0;
  1905. BIGNUM *r = NULL;
  1906. int trial;
  1907. if (!TEST_ptr(r = BN_new()))
  1908. goto err;
  1909. for (trial = 0; trial <= 1; ++trial) {
  1910. if (!TEST_true(BN_set_word(r, not_primes[i]))
  1911. || !TEST_false(BN_is_prime_fasttest_ex(r, 1, ctx, trial, NULL)))
  1912. goto err;
  1913. }
  1914. ret = 1;
  1915. err:
  1916. BN_free(r);
  1917. return ret;
  1918. }
  1919. static int file_test_run(STANZA *s)
  1920. {
  1921. static const FILETEST filetests[] = {
  1922. {"Sum", file_sum},
  1923. {"LShift1", file_lshift1},
  1924. {"LShift", file_lshift},
  1925. {"RShift", file_rshift},
  1926. {"Square", file_square},
  1927. {"Product", file_product},
  1928. {"Quotient", file_quotient},
  1929. {"ModMul", file_modmul},
  1930. {"ModExp", file_modexp},
  1931. {"Exp", file_exp},
  1932. {"ModSqrt", file_modsqrt},
  1933. };
  1934. int numtests = OSSL_NELEM(filetests);
  1935. const FILETEST *tp = filetests;
  1936. for ( ; --numtests >= 0; tp++) {
  1937. if (findattr(s, tp->name) != NULL) {
  1938. if (!tp->func(s)) {
  1939. TEST_info("%s:%d: Failed %s test",
  1940. s->test_file, s->start, tp->name);
  1941. return 0;
  1942. }
  1943. return 1;
  1944. }
  1945. }
  1946. TEST_info("%s:%d: Unknown test", s->test_file, s->start);
  1947. return 0;
  1948. }
  1949. static int run_file_tests(int i)
  1950. {
  1951. STANZA *s = NULL;
  1952. char *testfile = test_get_argument(i);
  1953. int c;
  1954. if (!TEST_ptr(s = OPENSSL_zalloc(sizeof(*s))))
  1955. return 0;
  1956. if (!test_start_file(s, testfile)) {
  1957. OPENSSL_free(s);
  1958. return 0;
  1959. }
  1960. /* Read test file. */
  1961. while (!BIO_eof(s->fp) && test_readstanza(s)) {
  1962. if (s->numpairs == 0)
  1963. continue;
  1964. if (!file_test_run(s))
  1965. s->errors++;
  1966. s->numtests++;
  1967. test_clearstanza(s);
  1968. }
  1969. test_end_file(s);
  1970. c = s->errors;
  1971. OPENSSL_free(s);
  1972. return c == 0;
  1973. }
  1974. int setup_tests(void)
  1975. {
  1976. int n = test_get_argument_count();
  1977. if (!TEST_ptr(ctx = BN_CTX_new()))
  1978. return 0;
  1979. if (n == 0) {
  1980. ADD_TEST(test_sub);
  1981. ADD_TEST(test_div_recip);
  1982. ADD_TEST(test_mod);
  1983. ADD_TEST(test_modexp_mont5);
  1984. ADD_TEST(test_kronecker);
  1985. ADD_TEST(test_rand);
  1986. ADD_TEST(test_bn2padded);
  1987. ADD_TEST(test_dec2bn);
  1988. ADD_TEST(test_hex2bn);
  1989. ADD_TEST(test_asc2bn);
  1990. ADD_ALL_TESTS(test_mpi, (int)OSSL_NELEM(kMPITests));
  1991. ADD_TEST(test_negzero);
  1992. ADD_TEST(test_badmod);
  1993. ADD_TEST(test_expmodzero);
  1994. ADD_TEST(test_expmodone);
  1995. ADD_TEST(test_smallprime);
  1996. ADD_TEST(test_swap);
  1997. #ifndef OPENSSL_NO_EC2M
  1998. ADD_TEST(test_gf2m_add);
  1999. ADD_TEST(test_gf2m_mod);
  2000. ADD_TEST(test_gf2m_mul);
  2001. ADD_TEST(test_gf2m_sqr);
  2002. ADD_TEST(test_gf2m_modinv);
  2003. ADD_TEST(test_gf2m_moddiv);
  2004. ADD_TEST(test_gf2m_modexp);
  2005. ADD_TEST(test_gf2m_modsqrt);
  2006. ADD_TEST(test_gf2m_modsolvequad);
  2007. #endif
  2008. ADD_ALL_TESTS(test_is_prime, (int)OSSL_NELEM(primes));
  2009. ADD_ALL_TESTS(test_not_prime, (int)OSSL_NELEM(not_primes));
  2010. } else {
  2011. ADD_ALL_TESTS(run_file_tests, n);
  2012. }
  2013. return 1;
  2014. }
  2015. void cleanup_tests(void)
  2016. {
  2017. BN_CTX_free(ctx);
  2018. }