Changes to Lenka's Montgomery implementation.

Submitted by: Lenka Fibikova

diff --git a/crypto/bn/bn_mont2.c b/crypto/bn/bn_mont2.c
index 16eca4488f408d9ee7e9e4527e861f12f69cb094..367eb09c5e4e813f003b1d5e9aafad0475c22cfd 100644 (file)
--- a/crypto/bn/bn_mont2.c
+++ b/crypto/bn/bn_mont2.c
@@ -14,8 +14,7 @@
 #include <stdlib.h>
 #include <assert.h>
 
-#include "bn.h"
-#include "bn_modfs.h"
+#include "bn_lcl.h"
 #include "bn_mont2.h"
 
 #define BN_mask_word(x, m) ((x->d[0]) & (m))
@@ -145,25 +144,97 @@ int BN_mont_set(BIGNUM *p, BN_MONTGOMERY *mont, BN_CTX *ctx)
        }
 
 
-static int BN_cpy_mul_word(BIGNUM *ret, BIGNUM *a, BN_ULONG w)
-/* ret = a * w */
+#ifdef BN_LLONG
+#define cpy_mul_add(r, b, a, w, c) { \
+       BN_ULLONG t; \
+       t = (BN_ULLONG)w * (a) + (b) + (c); \
+       (r)= Lw(t); \
+       (c)= Hw(t); \
+       }
+
+BN_ULONG BN_mul_add_rshift(BN_ULONG *r, BN_ULONG *a, int num, BN_ULONG w)
+/* r = (r + a * w) >> BN_BITS2 */
        {
-       if (BN_copy(ret, a) == NULL) return 0;
+       BN_ULONG c = 0;
 
-       if (!BN_mul_word(ret, w)) return 0;
+       mul_add(r[0], a[0], w, c);
+       if (--num == 0) return c;
+       a++;
 
-       return 1;
+       for (;;)
+               {
+               cpy_mul_add(r[0], r[1], a[0], w, c);
+               if (--num == 0) break;
+               cpy_mul_add(r[1], r[2], a[1], w, c);
+               if (--num == 0) break;
+               cpy_mul_add(r[2], r[3], a[2], w, c);
+               if (--num == 0) break;
+               cpy_mul_add(r[3], r[4], a[3], w, c);
+               if (--num == 0) break;
+               a += 4;
+               r += 4;
+               }
+       
+       return c;
+       }
+#else
+
+#define cpy_mul_add(r, b, a, bl, bh, c) { \
+       BN_ULONG l,h; \
+ \
+       h=(a); \
+       l=LBITS(h); \
+       h=HBITS(h); \
+       mul64(l,h,(bl),(bh)); \
+ \
+       /* non-multiply part */ \
+       l=(l+(c))&BN_MASK2; if (l < (c)) h++; \
+       (c)=(b); \
+       l=(l+(c))&BN_MASK2; if (l < (c)) h++; \
+       (c)=h&BN_MASK2; \
+       (r)=l; \
        }
 
+static BN_ULONG BN_mul_add_rshift(BN_ULONG *r, BN_ULONG *a, int num, BN_ULONG w)
+/* ret = (ret + a * w) << shift * BN_BITS2 */
+       {
+       BN_ULONG c = 0;
+       BN_ULONG bl, bh;
+
+       bl = LBITS(w);
+       bh = HBITS(w);
+
+       mul_add(r[0], a[0], bl, bh, c);
+       if (--num == 0) return c;
+       a++;
+
+       for (;;)
+               {
+               cpy_mul_add(r[0], r[1], a[0], bl, bh, c);
+               if (--num == 0) break;
+               cpy_mul_add(r[1], r[2], a[1], bl, bh, c);
+               if (--num == 0) break;
+               cpy_mul_add(r[2], r[3], a[2], bl, bh, c);
+               if (--num == 0) break;
+               cpy_mul_add(r[3], r[4], a[3], bl, bh, c);
+               if (--num == 0) break;
+               a += 4;
+               r += 4;
+               }
+       return c;
+       }
+#endif /* BN_LLONG */
 
-int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx)
+
+
+int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont)
 /* yR^{-1} (mod p) */
        {
-       int i;
-       BIGNUM *up, *p;
-       BN_ULONG u;
+       BIGNUM *p;
+       BN_ULONG c;
+       int i, max;
 
-       assert(y != NULL && mont != NULL && ctx != NULL);
+       assert(y != NULL && mont != NULL);
        assert(mont->p != NULL);
        assert(BN_cmp(y, mont->p) < 0);
        assert(!y->neg);
@@ -172,50 +243,40 @@ int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx)
        if (BN_is_zero(y)) return 1;
 
        p = mont->p;
+       max = mont->p_num_bytes;
 
-       BN_CTX_start(ctx);
-       up = BN_CTX_get(ctx);
-       if (up == NULL) goto err;
+       if (bn_wexpand(y, max) == NULL) return 0;
+       for (i = y->top; i < max; i++) y->d[i] = 0;
+       y->top = max;
 
-       for (i = 0; i < mont->p_num_bytes; i++)
+       /* r = [r + (y_0 * p') * p] / b */
+       for (i = 0; i < max; i++)
                {
-               u = (y->d[0]) * mont->p_inv_b_neg;                      /* u = y_0 * p' */
-
-               if (!BN_cpy_mul_word(up, p, u)) goto err;       /* up = u * p */
-
-               if (!BN_add(y, y, up)) goto err;                        
-#ifdef TEST
-               if (y->d[0]) goto err;
-#endif
-               if (!BN_rshift(y, y, BN_BITS2)) goto err;       /* y = (y + up)/b */
+               c = BN_mul_add_rshift(y->d, p->d, max, ((y->d[0]) * mont->p_inv_b_neg) & BN_MASK2); 
+               y->d[max - 1] = c;
                }
 
+       while (y->d[y->top - 1] == 0) y->top--;
 
-       if (BN_cmp(y, mont->p) >= 0)
+       if (BN_cmp(y, p) >= 0) 
                {
-               if (!BN_sub(y, y, mont->p)) goto err;
+               if (!BN_sub(y, y, p)) return 0;
                }
 
-       BN_CTX_end(ctx);
        return 1;
-
-err:
-       BN_CTX_end(ctx);
-       return 0;
        }
 
 
-int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx)
+int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont)
 /* r = x * y mod p */
 /* r != x && r! = y !!! */
        {
-       BIGNUM *xiy, *up;
-       BN_ULONG u;
-       int i;
-       
+       BN_ULONG c;
+       BIGNUM *p;
+       int i, j, max;
 
        assert(r != x && r != y);
-       assert(r != NULL && x != NULL  && y != NULL && mont != NULL && ctx != NULL);
+       assert(r != NULL && x != NULL  && y != NULL && mont != NULL);
        assert(mont->p != NULL);
        assert(BN_cmp(x, mont->p) < 0);
        assert(BN_cmp(y, mont->p) < 0);
@@ -228,56 +289,61 @@ int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX
                return 1;
                }
 
+       p = mont->p;
+       max = mont->p_num_bytes;
 
-
-       BN_CTX_start(ctx);
-       xiy = BN_CTX_get(ctx);
-       up = BN_CTX_get(ctx);
-       if (up == NULL) goto err;
-
-       if (!BN_zero(r)) goto err;
+       /* for multiplication we need at most max + 2 words
+               the last one --- max + 3 --- is only as a backstop
+               for incorrect input 
+       */
+       if (bn_wexpand(r, max + 3) == NULL) return 0;
+       for (i = 0; i < max + 3; i++) r->d[i] = 0;
+       r->top = max + 2;
 
        for (i = 0; i < x->top; i++)
                {
-               u = (r->d[0] + x->d[i] * y->d[0]) * mont->p_inv_b_neg;
-
-               if (!BN_cpy_mul_word(xiy, y, x->d[i])) goto err;
-               if (!BN_cpy_mul_word(up, mont->p, u)) goto err;
-
-               if (!BN_add(r, r, xiy)) goto err;
-               if (!BN_add(r, r, up)) goto err;
-
-#ifdef TEST
-               if (r->d[0]) goto err;
-#endif
-               if (!BN_rshift(r, r, BN_BITS2)) goto err;
+               /* r = r + (r_0 + x_i * y_0) * p' * p */
+               c = bn_mul_add_words(r->d, p->d, max, \
+                       ((r->d[0] + x->d[i] * y->d[0]) * mont->p_inv_b_neg) & BN_MASK2);
+               if (c)
+                       {
+                       if (((r->d[max] += c) & BN_MASK2) < c)
+                               if (((r->d[max + 1] ++) & BN_MASK2) == 0) return 0;
+                       }
+               
+               /* r = (r + x_i * y) / b */
+               c = BN_mul_add_rshift(r->d, y->d, y->top, x->d[i]); 
+               for(j = y->top; j <= max + 1; j++) r->d[j - 1] = r->d[j];
+               if (c)
+                       {
+                       if (((r->d[y->top - 1] += c) & BN_MASK2) < c)
+                               {
+                               j = y->top;
+                               while (((++ (r->d[j]) ) & BN_MASK2) == 0) 
+                                       j++;
+                               if (j > max) return 0;
+                               }
+                       }
+               r->d[max + 1] = 0;
                }
 
-       for (i = x->top; i < mont->p_num_bytes; i++)
+       for (i = x->top; i < max; i++)
                {
-               u = (r->d[0]) * mont->p_inv_b_neg;
-
-               if (!BN_cpy_mul_word(up, mont->p, u)) goto err;
-
-               if (!BN_add(r, r, up)) goto err;
-
-#ifdef TEST
-               if (r->d[0]) goto err;
-#endif
-               if (!BN_rshift(r, r, BN_BITS2)) goto err;
+               /* r = (r + r_0 * p' * p) / b */
+               c = BN_mul_add_rshift(r->d, p->d, max, ((r->d[0]) * mont->p_inv_b_neg) & BN_MASK2); 
+               j = max - 1;
+               r->d[j] = c + r->d[max];
+               if (r->d[j++] < c) r->d[j] = r->d[++j] + 1;
+               else r->d[j] = r->d[++j];
+               r->d[max + 1] = 0;
                }
 
+       while (r->d[r->top - 1] == 0) r->top--;
 
-       if (BN_cmp(r, mont->p) >= 0)
+       if (BN_cmp(r, mont->p) >= 0) 
                {
-               if (!BN_sub(r, r, mont->p)) goto err;
+               if (!BN_sub(r, r, mont->p)) return 0;
                }
 
-
-       BN_CTX_end(ctx);
        return 1;
-
-err:
-       BN_CTX_end(ctx);
-       return 0;
        }

diff --git a/crypto/bn/bn_mont2.h b/crypto/bn/bn_mont2.h
index 59f2657b9fc32fc71b378e05d025ebead663f7d5..cb42d67ad1563f778552b80f0dc5818b5bdc398c 100644 (file)
--- a/crypto/bn/bn_mont2.h
+++ b/crypto/bn/bn_mont2.h
@@ -23,14 +23,14 @@ typedef struct bn_mont_st{
        BN_ULONG p_inv_b_neg;   /* p' = p^{-1} mod b; b = 2^BN_BITS */
 } BN_MONTGOMERY;
 
-#define BN_from_mont(x, mont, ctx) (BN_mont_red((x), (mont), (ctx)))
+#define BN_from_mont(x, mont) (BN_mont_red((x), (mont)))
 
 
 BN_MONTGOMERY *BN_mont_new();
 int BN_to_mont(BIGNUM *x, BN_MONTGOMERY *mont, BN_CTX *ctx); 
 void BN_mont_clear_free(BN_MONTGOMERY *mont);
 int BN_mont_set(BIGNUM *p, BN_MONTGOMERY *mont, BN_CTX *ctx);
-int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx);
-BN_ULONG BN_mont_inv(BIGNUM *x, int e, BN_CTX *ctx);
+int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont);
+int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont);
 
 #endif

diff --git a/crypto/ec/ec.c b/crypto/ec/ec.c
index aec4c4e062588440e3027609734aa99d03d0578b..df54b47c0bd65154420d37f4fb6658c2e8dfb1dd 100644 (file)
--- a/crypto/ec/ec.c
+++ b/crypto/ec/ec.c
@@ -15,7 +15,6 @@
 #include <assert.h>
 
 #include "ec.h"
-#include "bn_modfs.h"
 
 
 
@@ -97,9 +96,9 @@ int EC_from_montgomery(EC *E, BN_MONTGOMERY *mont, BN_CTX *ctx)
 
        if (!E->is_in_mont) return 1;
 
-       if (!BN_mont_red(E->A, mont, ctx)) return 0;
-       if (!BN_mont_red(E->B, mont, ctx)) return 0;
-       if (!BN_mont_red(E->h, mont, ctx)) return 0;
+       if (!BN_mont_red(E->A, mont)) return 0;
+       if (!BN_mont_red(E->B, mont)) return 0;
+       if (!BN_mont_red(E->h, mont)) return 0;
 
        E->is_in_mont = 0;
        return 1;

diff --git a/crypto/ec/ec_point.c b/crypto/ec/ec_point.c
index aec392c085d0044827316b212956af4dba2b50e6..5dd2da3b1133aa84dc30390b2b2aa4e6c94dff44 100644 (file)
--- a/crypto/ec/ec_point.c
+++ b/crypto/ec/ec_point.c
@@ -16,7 +16,6 @@
 
 #include <openssl/bn.h>
 
-#include "../bn/bn_modfs.h" /* XXX */
 #include "../bn/bn_mont2.h" /* XXX */
 #include "ec.h"
 
@@ -965,9 +964,9 @@ int ECP_from_montgomery(EC_POINT *P, BN_MONTGOMERY *mont, BN_CTX *ctx)
 
        if (!P->is_in_mont) return 1;
 
-       if (!BN_mont_red(P->X, mont, ctx)) return 0;
-       if (!BN_mont_red(P->Y, mont, ctx)) return 0;
-       if (!BN_mont_red(P->Z, mont, ctx)) return 0;
+       if (!BN_mont_red(P->X, mont)) return 0;
+       if (!BN_mont_red(P->Y, mont)) return 0;
+       if (!BN_mont_red(P->Z, mont)) return 0;
 
        P->is_in_mont = 0;
        return 1;
@@ -1019,17 +1018,17 @@ int ECP_mont_cmp(EC_POINT *P, EC_POINT *Q, BN_MONTGOMERY *mont, BN_CTX *ctx)
        p = mont->p;
        
 
-       if (!BN_mont_mod_mul(n5, Q->Z, Q->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n1, P->X, n5, mont, ctx)) goto err;        /* L1 = x_p * z_q^2 */
+       if (!BN_mont_mod_mul(n5, Q->Z, Q->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n1, P->X, n5, mont)) goto err;     /* L1 = x_p * z_q^2 */
 
-       if (!BN_mont_mod_mul(n0, n5, Q->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n2, P->Y, n0, mont, ctx)) goto err;        /* L2 = y_p * z_q^3 */
+       if (!BN_mont_mod_mul(n0, n5, Q->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n2, P->Y, n0, mont)) goto err;     /* L2 = y_p * z_q^3 */
 
-       if (!BN_mont_mod_mul(n5, P->Z, P->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n3, Q->X, n5, mont, ctx)) goto err;        /* L3 = x_q * z_p^2 */
+       if (!BN_mont_mod_mul(n5, P->Z, P->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n3, Q->X, n5, mont)) goto err;     /* L3 = x_q * z_p^2 */
 
-       if (!BN_mont_mod_mul(n0, n5, P->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n4, Q->Y, n0, mont, ctx)) goto err;        /* L4 = y_q * z_p^3 */
+       if (!BN_mont_mod_mul(n0, n5, P->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n4, Q->Y, n0, mont)) goto err;     /* L4 = y_q * z_p^3 */
 
 
        if (!BN_mod_sub_quick(n0, n1, n3, p)) goto err;                 /* L5 = L1 - L3 */
@@ -1098,36 +1097,36 @@ int ECP_mont_double(EC_POINT *R, EC_POINT *P, EC *E, BN_MONTGOMERY *mont, BN_CTX
        p = E->p;
 
        /* L1 */
-       if (!BN_mont_mod_mul(n0, P->Z, P->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n2, n0, n0, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n0, n2, E->A, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n1, P->X, P->X, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n0, P->Z, P->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n2, n0, n0, mont)) goto err;
+       if (!BN_mont_mod_mul(n0, n2, E->A, mont)) goto err;
+       if (!BN_mont_mod_mul(n1, P->X, P->X, mont)) goto err;
        if (!BN_mod_lshift1_quick(n2, n1, p)) goto err;
        if (!BN_mod_add_quick(n1, n1, n2, p)) goto err;
        if (!BN_mod_add_quick(n1, n1, n0, p)) goto err;         /* L1 = 3 * x^2 + a * z^4 */
 
        /* Z */
-       if (!BN_mont_mod_mul(n0, P->Y, P->Z, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n0, P->Y, P->Z, mont)) goto err;
        if (!BN_mod_lshift1_quick(R->Z, n0, p)) goto err;               /* Z = 2 * y * z */
 
        /* L2 */
-       if (!BN_mont_mod_mul(n3, P->Y, P->Y, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n2, P->X, n3, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n3, P->Y, P->Y, mont)) goto err;
+       if (!BN_mont_mod_mul(n2, P->X, n3, mont)) goto err;
        if (!BN_mod_lshift_quick(n2, n2, 2, p)) goto err;               /* L2 = 4 * x * y^2 */
 
        /* X */
        if (!BN_mod_lshift1_quick(n0, n2, p)) goto err;
-       if (!BN_mont_mod_mul(R->X, n1, n1, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(R->X, n1, n1, mont)) goto err;
        if (!BN_mod_sub_quick(R->X, R->X, n0, p)) goto err;     /* X = L1^2 - 2 * L2 */
        
        /* L3 */
-       if (!BN_mont_mod_mul(n0, n3, n3, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n0, n3, n3, mont)) goto err;
        if (!BN_mod_lshift_quick(n3, n0, 3, p)) goto err;               /* L3 = 8 * y^4 */
 
        
        /* Y */
        if (!BN_mod_sub_quick(n2, n2, R->X, p)) goto err;
-       if (!BN_mont_mod_mul(n0, n1, n2, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n0, n1, n2, mont)) goto err;
        if (!BN_mod_sub_quick(R->Y, n0, n3, p)) goto err;               /* Y = L1 * (L2 - X) - L3 */
 
        BN_CTX_end(ctx);
@@ -1190,19 +1189,19 @@ int ECP_mont_add(EC_POINT *R, EC_POINT *P, EC_POINT *Q, EC *E, BN_MONTGOMERY *mo
        R->is_in_mont = 1;
        
        /* L1; L2 */
-       if (!BN_mont_mod_mul(n6, Q->Z, Q->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n1, P->X, n6, mont, ctx)) goto err;        /* L1 = x_p * z_q^2 */
+       if (!BN_mont_mod_mul(n6, Q->Z, Q->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n1, P->X, n6, mont)) goto err;     /* L1 = x_p * z_q^2 */
 
-       if (!BN_mont_mod_mul(n0, n6, Q->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n2, P->Y, n0, mont, ctx)) goto err;        /* L2 = y_p * z_q^3 */
+       if (!BN_mont_mod_mul(n0, n6, Q->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n2, P->Y, n0, mont)) goto err;     /* L2 = y_p * z_q^3 */
 
 
        /* L3; L4 */
-       if (!BN_mont_mod_mul(n6, P->Z, P->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n3, Q->X, n6, mont, ctx)) goto err;        /* L3 = x_q * z_p^2 */
+       if (!BN_mont_mod_mul(n6, P->Z, P->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n3, Q->X, n6, mont)) goto err;     /* L3 = x_q * z_p^2 */
 
-       if (!BN_mont_mod_mul(n0, n6, P->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n4, Q->Y, n0, mont, ctx)) goto err;        /* L4 = y_q * z_p^3 */
+       if (!BN_mont_mod_mul(n0, n6, P->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(n4, Q->Y, n0, mont)) goto err;     /* L4 = y_q * z_p^3 */
 
 
        /* L5; L6 */
@@ -1232,14 +1231,14 @@ int ECP_mont_add(EC_POINT *R, EC_POINT *P, EC_POINT *Q, EC *E, BN_MONTGOMERY *mo
 
 
        /* Z */
-       if (!BN_mont_mod_mul(n0, P->Z, Q->Z, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(R->Z, n0, n5, mont, ctx)) goto err;        /* Z = z_p * z_q * L_5 */
+       if (!BN_mont_mod_mul(n0, P->Z, Q->Z, mont)) goto err;
+       if (!BN_mont_mod_mul(R->Z, n0, n5, mont)) goto err;     /* Z = z_p * z_q * L_5 */
 
 
        /* X */
-       if (!BN_mont_mod_mul(n0, n6, n6, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n4, n5, n5, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n3, n1, n4, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n0, n6, n6, mont)) goto err;
+       if (!BN_mont_mod_mul(n4, n5, n5, mont)) goto err;
+       if (!BN_mont_mod_mul(n3, n1, n4, mont)) goto err;
        if (!BN_mod_sub_quick(R->X, n0, n3, p)) goto err;                       /* X = L6^2 - L5^2 * L7 */
 
        
@@ -1249,11 +1248,11 @@ int ECP_mont_add(EC_POINT *R, EC_POINT *P, EC_POINT *Q, EC *E, BN_MONTGOMERY *mo
 
 
        /* Y */
-       if (!BN_mont_mod_mul(n0, n3, n6, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n6, n4, n5, mont, ctx)) goto err;
-       if (!BN_mont_mod_mul(n1, n2, n6, mont, ctx)) goto err;
+       if (!BN_mont_mod_mul(n0, n3, n6, mont)) goto err;
+       if (!BN_mont_mod_mul(n6, n4, n5, mont)) goto err;
+       if (!BN_mont_mod_mul(n1, n2, n6, mont)) goto err;
        if (!BN_mod_sub_quick(n0, n0, n1, p)) goto err;
-       if (!BN_mont_mod_mul(R->Y, n0, E->h, mont, ctx)) goto err;      /* Y = (L6 * L9 - L8 * L5^3) / 2 */
+       if (!BN_mont_mod_mul(R->Y, n0, E->h, mont)) goto err;   /* Y = (L6 * L9 - L8 * L5^3) / 2 */
 
 
        BN_CTX_end(ctx);