- /* dmp1 = d mod (p-1)? */
- BN_sub(i, key->p, BN_value_one());
- BN_mod(j, key->d, i, ctx);
- if (BN_cmp(j, key->dmp1) != 0)
+ /* d*e = 1 mod lcm(p-1,q-1)? */
+
+ r = BN_sub(i, key->p, BN_value_one());
+ if (!r) { ret = -1; goto err; }
+ r = BN_sub(j, key->q, BN_value_one());
+ if (!r) { ret = -1; goto err; }
+
+ /* now compute k = lcm(i,j) */
+ r = BN_mul(l, i, j, ctx);
+ if (!r) { ret = -1; goto err; }
+ r = BN_gcd(m, i, j, ctx);
+ if (!r) { ret = -1; goto err; }
+ r = BN_div(k, NULL, l, m, ctx); /* remainder is 0 */
+ if (!r) { ret = -1; goto err; }
+
+ r = BN_mod_mul(i, key->d, key->e, k, ctx);
+ if (!r) { ret = -1; goto err; }
+
+ if (!BN_is_one(i))