2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
14 int BN_lshift1(BIGNUM *r, const BIGNUM *a)
16 register BN_ULONG *ap, *rp, t, c;
24 if (bn_wexpand(r, a->top + 1) == NULL)
28 if (bn_wexpand(r, a->top + 1) == NULL)
34 for (i = 0; i < a->top; i++) {
36 *(rp++) = ((t << 1) | c) & BN_MASK2;
37 c = (t & BN_TBIT) ? 1 : 0;
47 int BN_rshift1(BIGNUM *r, const BIGNUM *a)
49 BN_ULONG *ap, *rp, t, c;
61 j = i - (ap[i - 1] == 1);
63 if (bn_wexpand(r, j) == NULL)
69 c = (t & 1) ? BN_TBIT : 0;
74 rp[i] = ((t >> 1) & BN_MASK2) | c;
75 c = (t & 1) ? BN_TBIT : 0;
79 r->neg = 0; /* don't allow negative zero */
84 int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
89 BNerr(BN_F_BN_LSHIFT, BN_R_INVALID_SHIFT);
93 ret = bn_lshift_fixed_top(r, a, n);
102 * In respect to shift factor the execution time is invariant of
103 * |n % BN_BITS2|, but not |n / BN_BITS2|. Or in other words pre-condition
104 * for constant-time-ness is |n < BN_BITS2| or |n / BN_BITS2| being
107 int bn_lshift_fixed_top(BIGNUM *r, const BIGNUM *a, int n)
112 BN_ULONG l, m, rmask = 0;
120 if (bn_wexpand(r, a->top + nw + 1) == NULL)
124 lb = (unsigned int)n % BN_BITS2;
126 rb %= BN_BITS2; /* say no to undefined behaviour */
127 rmask = (BN_ULONG)0 - rb; /* rmask = 0 - (rb != 0) */
132 t[a->top] = (l >> rb) & rmask;
133 for (i = a->top - 1; i > 0; i--) {
136 t[i] = (m | ((l >> rb) & rmask)) & BN_MASK2;
138 t[0] = (l << lb) & BN_MASK2;
140 /* shouldn't happen, but formally required */
144 memset(r->d, 0, sizeof(*t) * nw);
147 r->top = a->top + nw + 1;
148 r->flags |= BN_FLG_FIXED_TOP;
153 int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
155 int i, j, nw, lb, rb;
163 BNerr(BN_F_BN_RSHIFT, BN_R_INVALID_SHIFT);
170 if (nw >= a->top || a->top == 0) {
174 i = (BN_num_bits(a) - n + (BN_BITS2 - 1)) / BN_BITS2;
176 if (bn_wexpand(r, i) == NULL)
181 return 1; /* or the copying loop will go berserk */
190 for (i = j; i != 0; i--)
194 for (i = j - 1; i != 0; i--) {
195 tmp = (l >> rb) & BN_MASK2;
197 *(t++) = (tmp | (l << lb)) & BN_MASK2;
199 if ((l = (l >> rb) & BN_MASK2))
203 r->neg = 0; /* don't allow negative zero */
209 * In respect to shift factor the execution time is invariant of
210 * |n % BN_BITS2|, but not |n / BN_BITS2|. Or in other words pre-condition
211 * for constant-time-ness for sufficiently[!] zero-padded inputs is
212 * |n < BN_BITS2| or |n / BN_BITS2| being non-secret.
214 int bn_rshift_fixed_top(BIGNUM *r, const BIGNUM *a, int n)
228 /* shouldn't happen, but formally required */
233 rb = (unsigned int)n % BN_BITS2;
235 lb %= BN_BITS2; /* say no to undefined behaviour */
236 mask = (BN_ULONG)0 - lb; /* mask = 0 - (lb != 0) */
239 if (r != a && bn_wexpand(r, top) == NULL)
245 for (i = 0; i < top - 1; i++) {
247 t[i] = (l >> rb) | ((m << lb) & mask);
254 r->flags |= BN_FLG_FIXED_TOP;