1 /**
2  * \file bignum.h
3  *
4  * \brief Multi-precision integer library
5  */
6 /*
7  *  Copyright The Mbed TLS Contributors
8  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
9  */
10 #ifndef MBEDTLS_BIGNUM_H
11 #define MBEDTLS_BIGNUM_H
12 #include "mbedtls/private_access.h"
13 
14 #include "mbedtls/build_info.h"
15 
16 #include <stddef.h>
17 #include <stdint.h>
18 
19 #if defined(MBEDTLS_FS_IO)
20 #include <stdio.h>
21 #endif
22 
23 /** An error occurred while reading from or writing to a file. */
24 #define MBEDTLS_ERR_MPI_FILE_IO_ERROR                     -0x0002
25 /** Bad input parameters to function. */
26 #define MBEDTLS_ERR_MPI_BAD_INPUT_DATA                    -0x0004
27 /** There is an invalid character in the digit string. */
28 #define MBEDTLS_ERR_MPI_INVALID_CHARACTER                 -0x0006
29 /** The buffer is too small to write to. */
30 #define MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL                  -0x0008
31 /** The input arguments are negative or result in illegal output. */
32 #define MBEDTLS_ERR_MPI_NEGATIVE_VALUE                    -0x000A
33 /** The input argument for division is zero, which is not allowed. */
34 #define MBEDTLS_ERR_MPI_DIVISION_BY_ZERO                  -0x000C
35 /** The input arguments are not acceptable. */
36 #define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE                    -0x000E
37 /** Memory allocation failed. */
38 #define MBEDTLS_ERR_MPI_ALLOC_FAILED                      -0x0010
39 
40 #define MBEDTLS_MPI_CHK(f)       \
41     do                           \
42     {                            \
43         if ((ret = (f)) != 0) \
44         goto cleanup;        \
45     } while (0)
46 
47 /*
48  * Maximum size MPIs are allowed to grow to in number of limbs.
49  */
50 #define MBEDTLS_MPI_MAX_LIMBS                             10000
51 
52 #if !defined(MBEDTLS_MPI_WINDOW_SIZE)
53 /*
54  * Maximum window size used for modular exponentiation. Default: 3
55  * Minimum value: 1. Maximum value: 6.
56  *
57  * Result is an array of ( 2 ** MBEDTLS_MPI_WINDOW_SIZE ) MPIs used
58  * for the sliding window calculation. (So 8 by default)
59  *
60  * Reduction in size, reduces speed.
61  */
62 #define MBEDTLS_MPI_WINDOW_SIZE                           3        /**< Maximum window size used. */
63 #endif /* !MBEDTLS_MPI_WINDOW_SIZE */
64 
65 #if !defined(MBEDTLS_MPI_MAX_SIZE)
66 /*
67  * Maximum size of MPIs allowed in bits and bytes for user-MPIs.
68  * ( Default: 512 bytes => 4096 bits, Maximum tested: 2048 bytes => 16384 bits )
69  *
70  * Note: Calculations can temporarily result in larger MPIs. So the number
71  * of limbs required (MBEDTLS_MPI_MAX_LIMBS) is higher.
72  */
73 #define MBEDTLS_MPI_MAX_SIZE                              1024     /**< Maximum number of bytes for usable MPIs. */
74 #endif /* !MBEDTLS_MPI_MAX_SIZE */
75 
76 #define MBEDTLS_MPI_MAX_BITS                              (8 * MBEDTLS_MPI_MAX_SIZE)      /**< Maximum number of bits for usable MPIs. */
77 
78 /*
79  * When reading from files with mbedtls_mpi_read_file() and writing to files with
80  * mbedtls_mpi_write_file() the buffer should have space
81  * for a (short) label, the MPI (in the provided radix), the newline
82  * characters and the '\0'.
83  *
84  * By default we assume at least a 10 char label, a minimum radix of 10
85  * (decimal) and a maximum of 4096 bit numbers (1234 decimal chars).
86  * Autosized at compile time for at least a 10 char label, a minimum radix
87  * of 10 (decimal) for a number of MBEDTLS_MPI_MAX_BITS size.
88  *
89  * This used to be statically sized to 1250 for a maximum of 4096 bit
90  * numbers (1234 decimal chars).
91  *
92  * Calculate using the formula:
93  *  MBEDTLS_MPI_RW_BUFFER_SIZE = ceil(MBEDTLS_MPI_MAX_BITS / ln(10) * ln(2)) +
94  *                                LabelSize + 6
95  */
96 #define MBEDTLS_MPI_MAX_BITS_SCALE100          (100 * MBEDTLS_MPI_MAX_BITS)
97 #define MBEDTLS_LN_2_DIV_LN_10_SCALE100                 332
98 #define MBEDTLS_MPI_RW_BUFFER_SIZE             (((MBEDTLS_MPI_MAX_BITS_SCALE100 + \
99                                                   MBEDTLS_LN_2_DIV_LN_10_SCALE100 - 1) / \
100                                                  MBEDTLS_LN_2_DIV_LN_10_SCALE100) + 10 + 6)
101 
102 /*
103  * Define the base integer type, architecture-wise.
104  *
105  * 32 or 64-bit integer types can be forced regardless of the underlying
106  * architecture by defining MBEDTLS_HAVE_INT32 or MBEDTLS_HAVE_INT64
107  * respectively and undefining MBEDTLS_HAVE_ASM.
108  *
109  * Double-width integers (e.g. 128-bit in 64-bit architectures) can be
110  * disabled by defining MBEDTLS_NO_UDBL_DIVISION.
111  */
112 #if !defined(MBEDTLS_HAVE_INT32)
113     #if defined(_MSC_VER) && defined(_M_AMD64)
114 /* Always choose 64-bit when using MSC */
115         #if !defined(MBEDTLS_HAVE_INT64)
116             #define MBEDTLS_HAVE_INT64
117         #endif /* !MBEDTLS_HAVE_INT64 */
118 typedef  int64_t mbedtls_mpi_sint;
119 typedef uint64_t mbedtls_mpi_uint;
120 #define MBEDTLS_MPI_UINT_MAX                UINT64_MAX
121     #elif defined(__GNUC__) && (                         \
122     defined(__amd64__) || defined(__x86_64__)     || \
123     defined(__ppc64__) || defined(__powerpc64__)  || \
124     defined(__ia64__)  || defined(__alpha__)      || \
125     (defined(__sparc__) && defined(__arch64__)) || \
126     defined(__s390x__) || defined(__mips64)       || \
127     defined(__aarch64__))
128         #if !defined(MBEDTLS_HAVE_INT64)
129             #define MBEDTLS_HAVE_INT64
130         #endif /* MBEDTLS_HAVE_INT64 */
131 typedef  int64_t mbedtls_mpi_sint;
132 typedef uint64_t mbedtls_mpi_uint;
133 #define MBEDTLS_MPI_UINT_MAX                UINT64_MAX
134         #if !defined(MBEDTLS_NO_UDBL_DIVISION)
135 /* mbedtls_t_udbl defined as 128-bit unsigned int */
136 typedef unsigned int mbedtls_t_udbl __attribute__((mode(TI)));
137             #define MBEDTLS_HAVE_UDBL
138         #endif /* !MBEDTLS_NO_UDBL_DIVISION */
139     #elif defined(__ARMCC_VERSION) && defined(__aarch64__)
140 /*
141  * __ARMCC_VERSION is defined for both armcc and armclang and
142  * __aarch64__ is only defined by armclang when compiling 64-bit code
143  */
144         #if !defined(MBEDTLS_HAVE_INT64)
145             #define MBEDTLS_HAVE_INT64
146         #endif /* !MBEDTLS_HAVE_INT64 */
147 typedef  int64_t mbedtls_mpi_sint;
148 typedef uint64_t mbedtls_mpi_uint;
149 #define MBEDTLS_MPI_UINT_MAX                UINT64_MAX
150         #if !defined(MBEDTLS_NO_UDBL_DIVISION)
151 /* mbedtls_t_udbl defined as 128-bit unsigned int */
152 typedef __uint128_t mbedtls_t_udbl;
153             #define MBEDTLS_HAVE_UDBL
154         #endif /* !MBEDTLS_NO_UDBL_DIVISION */
155     #elif defined(MBEDTLS_HAVE_INT64)
156 /* Force 64-bit integers with unknown compiler */
157 typedef  int64_t mbedtls_mpi_sint;
158 typedef uint64_t mbedtls_mpi_uint;
159 #define MBEDTLS_MPI_UINT_MAX                UINT64_MAX
160     #endif
161 #endif /* !MBEDTLS_HAVE_INT32 */
162 
163 #if !defined(MBEDTLS_HAVE_INT64)
164 /* Default to 32-bit compilation */
165     #if !defined(MBEDTLS_HAVE_INT32)
166         #define MBEDTLS_HAVE_INT32
167     #endif /* !MBEDTLS_HAVE_INT32 */
168 typedef  int32_t mbedtls_mpi_sint;
169 typedef uint32_t mbedtls_mpi_uint;
170 #define MBEDTLS_MPI_UINT_MAX                UINT32_MAX
171     #if !defined(MBEDTLS_NO_UDBL_DIVISION)
172 typedef uint64_t mbedtls_t_udbl;
173         #define MBEDTLS_HAVE_UDBL
174     #endif /* !MBEDTLS_NO_UDBL_DIVISION */
175 #endif /* !MBEDTLS_HAVE_INT64 */
176 
177 /*
178  * Sanity check that exactly one of MBEDTLS_HAVE_INT32 or MBEDTLS_HAVE_INT64 is defined,
179  * so that code elsewhere doesn't have to check.
180  */
181 #if (!(defined(MBEDTLS_HAVE_INT32) || defined(MBEDTLS_HAVE_INT64))) || \
182     (defined(MBEDTLS_HAVE_INT32) && defined(MBEDTLS_HAVE_INT64))
183 #error "Only 32-bit or 64-bit limbs are supported in bignum"
184 #endif
185 
186 /** \typedef mbedtls_mpi_uint
187  * \brief The type of machine digits in a bignum, called _limbs_.
188  *
189  * This is always an unsigned integer type with no padding bits. The size
190  * is platform-dependent.
191  */
192 
193 /** \typedef mbedtls_mpi_sint
194  * \brief The signed type corresponding to #mbedtls_mpi_uint.
195  *
196  * This is always an signed integer type with no padding bits. The size
197  * is platform-dependent.
198  */
199 
200 #ifdef __cplusplus
201 extern "C" {
202 #endif
203 
204 /**
205  * \brief          MPI structure
206  */
207 typedef struct mbedtls_mpi {
208     /** Pointer to limbs.
209      *
210      * This may be \c NULL if \c n is 0.
211      */
212     mbedtls_mpi_uint *MBEDTLS_PRIVATE(p);
213 
214     /** Sign: -1 if the mpi is negative, 1 otherwise.
215      *
216      * The number 0 must be represented with `s = +1`. Although many library
217      * functions treat all-limbs-zero as equivalent to a valid representation
218      * of 0 regardless of the sign bit, there are exceptions, so bignum
219      * functions and external callers must always set \c s to +1 for the
220      * number zero.
221      *
222      * Note that this implies that calloc() or `... = {0}` does not create
223      * a valid MPI representation. You must call mbedtls_mpi_init().
224      */
225     signed short MBEDTLS_PRIVATE(s);
226 
227     /** Total number of limbs in \c p.  */
228     unsigned short MBEDTLS_PRIVATE(n);
229     /* Make sure that MBEDTLS_MPI_MAX_LIMBS fits in n.
230      * Use the same limit value on all platforms so that we don't have to
231      * think about different behavior on the rare platforms where
232      * unsigned short can store values larger than the minimum required by
233      * the C language, which is 65535.
234      */
235 #if MBEDTLS_MPI_MAX_LIMBS > 65535
236 #error "MBEDTLS_MPI_MAX_LIMBS > 65535 is not supported"
237 #endif
238 
239     short use_mempool;
240 
241 }
242 mbedtls_mpi;
243 
244 extern void *mbedtls_mpi_mempool;
245 
246 /**
247  * \brief           Initialize an MPI context.
248  *
249  *                  This makes the MPI ready to be set or freed,
250  *                  but does not define a value for the MPI.
251  *
252  * \param X         The MPI context to initialize. This must not be \c NULL.
253  */
254 void mbedtls_mpi_init(mbedtls_mpi *X);
255 void mbedtls_mpi_init_mempool(mbedtls_mpi *X);
256 
257 /**
258  * \brief          This function frees the components of an MPI context.
259  *
260  * \param X        The MPI context to be cleared. This may be \c NULL,
261  *                 in which case this function is a no-op. If it is
262  *                 not \c NULL, it must point to an initialized MPI.
263  */
264 void mbedtls_mpi_free(mbedtls_mpi *X);
265 
266 /**
267  * \brief          Enlarge an MPI to the specified number of limbs.
268  *
269  * \note           This function does nothing if the MPI is
270  *                 already large enough.
271  *
272  * \param X        The MPI to grow. It must be initialized.
273  * \param nblimbs  The target number of limbs.
274  *
275  * \return         \c 0 if successful.
276  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
277  * \return         Another negative error code on other kinds of failure.
278  */
279 int mbedtls_mpi_grow(mbedtls_mpi *X, size_t nblimbs);
280 
281 /**
282  * \brief          This function resizes an MPI downwards, keeping at least the
283  *                 specified number of limbs.
284  *
285  *                 If \c X is smaller than \c nblimbs, it is resized up
286  *                 instead.
287  *
288  * \param X        The MPI to shrink. This must point to an initialized MPI.
289  * \param nblimbs  The minimum number of limbs to keep.
290  *
291  * \return         \c 0 if successful.
292  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed
293  *                 (this can only happen when resizing up).
294  * \return         Another negative error code on other kinds of failure.
295  */
296 int mbedtls_mpi_shrink(mbedtls_mpi *X, size_t nblimbs);
297 
298 /**
299  * \brief          Make a copy of an MPI.
300  *
301  * \param X        The destination MPI. This must point to an initialized MPI.
302  * \param Y        The source MPI. This must point to an initialized MPI.
303  *
304  * \note           The limb-buffer in the destination MPI is enlarged
305  *                 if necessary to hold the value in the source MPI.
306  *
307  * \return         \c 0 if successful.
308  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
309  * \return         Another negative error code on other kinds of failure.
310  */
311 int mbedtls_mpi_copy(mbedtls_mpi *X, const mbedtls_mpi *Y);
312 
313 /**
314  * \brief          Swap the contents of two MPIs.
315  *
316  * \param X        The first MPI. It must be initialized.
317  * \param Y        The second MPI. It must be initialized.
318  */
319 void mbedtls_mpi_swap(mbedtls_mpi *X, mbedtls_mpi *Y);
320 
321 /**
322  * \brief          Perform a safe conditional copy of MPI which doesn't
323  *                 reveal whether the condition was true or not.
324  *
325  * \param X        The MPI to conditionally assign to. This must point
326  *                 to an initialized MPI.
327  * \param Y        The MPI to be assigned from. This must point to an
328  *                 initialized MPI.
329  * \param assign   The condition deciding whether to perform the
330  *                 assignment or not. Must be either 0 or 1:
331  *                 * \c 1: Perform the assignment `X = Y`.
332  *                 * \c 0: Keep the original value of \p X.
333  *
334  * \note           This function is equivalent to
335  *                      `if( assign ) mbedtls_mpi_copy( X, Y );`
336  *                 except that it avoids leaking any information about whether
337  *                 the assignment was done or not (the above code may leak
338  *                 information through branch prediction and/or memory access
339  *                 patterns analysis).
340  *
341  * \warning        If \p assign is neither 0 nor 1, the result of this function
342  *                 is indeterminate, and the resulting value in \p X might be
343  *                 neither its original value nor the value in \p Y.
344  *
345  * \return         \c 0 if successful.
346  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
347  * \return         Another negative error code on other kinds of failure.
348  */
349 int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X, const mbedtls_mpi *Y, unsigned char assign);
350 
351 /**
352  * \brief          Perform a safe conditional swap which doesn't
353  *                 reveal whether the condition was true or not.
354  *
355  * \param X        The first MPI. This must be initialized.
356  * \param Y        The second MPI. This must be initialized.
357  * \param swap     The condition deciding whether to perform
358  *                 the swap or not. Must be either 0 or 1:
359  *                 * \c 1: Swap the values of \p X and \p Y.
360  *                 * \c 0: Keep the original values of \p X and \p Y.
361  *
362  * \note           This function is equivalent to
363  *                      if( swap ) mbedtls_mpi_swap( X, Y );
364  *                 except that it avoids leaking any information about whether
365  *                 the swap was done or not (the above code may leak
366  *                 information through branch prediction and/or memory access
367  *                 patterns analysis).
368  *
369  * \warning        If \p swap is neither 0 nor 1, the result of this function
370  *                 is indeterminate, and both \p X and \p Y might end up with
371  *                 values different to either of the original ones.
372  *
373  * \return         \c 0 if successful.
374  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
375  * \return         Another negative error code on other kinds of failure.
376  *
377  */
378 int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X, mbedtls_mpi *Y, unsigned char swap);
379 
380 /**
381  * \brief          Store integer value in MPI.
382  *
383  * \param X        The MPI to set. This must be initialized.
384  * \param z        The value to use.
385  *
386  * \return         \c 0 if successful.
387  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
388  * \return         Another negative error code on other kinds of failure.
389  */
390 int mbedtls_mpi_lset(mbedtls_mpi *X, mbedtls_mpi_sint z);
391 
392 /**
393  * \brief          Get a specific bit from an MPI.
394  *
395  * \param X        The MPI to query. This must be initialized.
396  * \param pos      Zero-based index of the bit to query.
397  *
398  * \return         \c 0 or \c 1 on success, depending on whether bit \c pos
399  *                 of \c X is unset or set.
400  * \return         A negative error code on failure.
401  */
402 int mbedtls_mpi_get_bit(const mbedtls_mpi *X, size_t pos);
403 
404 /**
405  * \brief          Modify a specific bit in an MPI.
406  *
407  * \note           This function will grow the target MPI if necessary to set a
408  *                 bit to \c 1 in a not yet existing limb. It will not grow if
409  *                 the bit should be set to \c 0.
410  *
411  * \param X        The MPI to modify. This must be initialized.
412  * \param pos      Zero-based index of the bit to modify.
413  * \param val      The desired value of bit \c pos: \c 0 or \c 1.
414  *
415  * \return         \c 0 if successful.
416  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
417  * \return         Another negative error code on other kinds of failure.
418  */
419 int mbedtls_mpi_set_bit(mbedtls_mpi *X, size_t pos, unsigned char val);
420 
421 /**
422  * \brief          Return the number of bits of value \c 0 before the
423  *                 least significant bit of value \c 1.
424  *
425  * \note           This is the same as the zero-based index of
426  *                 the least significant bit of value \c 1.
427  *
428  * \param X        The MPI to query.
429  *
430  * \return         The number of bits of value \c 0 before the least significant
431  *                 bit of value \c 1 in \p X.
432  */
433 size_t mbedtls_mpi_lsb(const mbedtls_mpi *X);
434 
435 /**
436  * \brief          Return the number of bits up to and including the most
437  *                 significant bit of value \c 1.
438  *
439  * * \note         This is same as the one-based index of the most
440  *                 significant bit of value \c 1.
441  *
442  * \param X        The MPI to query. This must point to an initialized MPI.
443  *
444  * \return         The number of bits up to and including the most
445  *                 significant bit of value \c 1.
446  */
447 size_t mbedtls_mpi_bitlen(const mbedtls_mpi *X);
448 
449 /**
450  * \brief          Return the total size of an MPI value in bytes.
451  *
452  * \param X        The MPI to use. This must point to an initialized MPI.
453  *
454  * \note           The value returned by this function may be less than
455  *                 the number of bytes used to store \p X internally.
456  *                 This happens if and only if there are trailing bytes
457  *                 of value zero.
458  *
459  * \return         The least number of bytes capable of storing
460  *                 the absolute value of \p X.
461  */
462 size_t mbedtls_mpi_size(const mbedtls_mpi *X);
463 
464 /**
465  * \brief          Import an MPI from an ASCII string.
466  *
467  * \param X        The destination MPI. This must point to an initialized MPI.
468  * \param radix    The numeric base of the input string.
469  * \param s        Null-terminated string buffer.
470  *
471  * \return         \c 0 if successful.
472  * \return         A negative error code on failure.
473  */
474 int mbedtls_mpi_read_string(mbedtls_mpi *X, int radix, const char *s);
475 
476 /**
477  * \brief          Export an MPI to an ASCII string.
478  *
479  * \param X        The source MPI. This must point to an initialized MPI.
480  * \param radix    The numeric base of the output string.
481  * \param buf      The buffer to write the string to. This must be writable
482  *                 buffer of length \p buflen Bytes.
483  * \param buflen   The available size in Bytes of \p buf.
484  * \param olen     The address at which to store the length of the string
485  *                 written, including the  final \c NULL byte. This must
486  *                 not be \c NULL.
487  *
488  * \note           You can call this function with `buflen == 0` to obtain the
489  *                 minimum required buffer size in `*olen`.
490  *
491  * \return         \c 0 if successful.
492  * \return         #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the target buffer \p buf
493  *                 is too small to hold the value of \p X in the desired base.
494  *                 In this case, `*olen` is nonetheless updated to contain the
495  *                 size of \p buf required for a successful call.
496  * \return         Another negative error code on different kinds of failure.
497  */
498 int mbedtls_mpi_write_string(const mbedtls_mpi *X, int radix,
499                              char *buf, size_t buflen, size_t *olen);
500 
501 #if defined(MBEDTLS_FS_IO)
502 /**
503  * \brief          Read an MPI from a line in an opened file.
504  *
505  * \param X        The destination MPI. This must point to an initialized MPI.
506  * \param radix    The numeric base of the string representation used
507  *                 in the source line.
508  * \param fin      The input file handle to use. This must not be \c NULL.
509  *
510  * \note           On success, this function advances the file stream
511  *                 to the end of the current line or to EOF.
512  *
513  *                 The function returns \c 0 on an empty line.
514  *
515  *                 Leading whitespaces are ignored, as is a
516  *                 '0x' prefix for radix \c 16.
517  *
518  * \return         \c 0 if successful.
519  * \return         #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the file read buffer
520  *                 is too small.
521  * \return         Another negative error code on failure.
522  */
523 int mbedtls_mpi_read_file(mbedtls_mpi *X, int radix, FILE *fin);
524 
525 /**
526  * \brief          Export an MPI into an opened file.
527  *
528  * \param p        A string prefix to emit prior to the MPI data.
529  *                 For example, this might be a label, or "0x" when
530  *                 printing in base \c 16. This may be \c NULL if no prefix
531  *                 is needed.
532  * \param X        The source MPI. This must point to an initialized MPI.
533  * \param radix    The numeric base to be used in the emitted string.
534  * \param fout     The output file handle. This may be \c NULL, in which case
535  *                 the output is written to \c stdout.
536  *
537  * \return         \c 0 if successful.
538  * \return         A negative error code on failure.
539  */
540 int mbedtls_mpi_write_file(const char *p, const mbedtls_mpi *X,
541                            int radix, FILE *fout);
542 #endif /* MBEDTLS_FS_IO */
543 
544 /**
545  * \brief          Import an MPI from unsigned big endian binary data.
546  *
547  * \param X        The destination MPI. This must point to an initialized MPI.
548  * \param buf      The input buffer. This must be a readable buffer of length
549  *                 \p buflen Bytes.
550  * \param buflen   The length of the input buffer \p buf in Bytes.
551  *
552  * \return         \c 0 if successful.
553  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
554  * \return         Another negative error code on different kinds of failure.
555  */
556 int mbedtls_mpi_read_binary(mbedtls_mpi *X, const unsigned char *buf,
557                             size_t buflen);
558 
559 /**
560  * \brief          Import X from unsigned binary data, little endian
561  *
562  * \param X        The destination MPI. This must point to an initialized MPI.
563  * \param buf      The input buffer. This must be a readable buffer of length
564  *                 \p buflen Bytes.
565  * \param buflen   The length of the input buffer \p buf in Bytes.
566  *
567  * \return         \c 0 if successful.
568  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
569  * \return         Another negative error code on different kinds of failure.
570  */
571 int mbedtls_mpi_read_binary_le(mbedtls_mpi *X,
572                                const unsigned char *buf, size_t buflen);
573 
574 /**
575  * \brief          Export X into unsigned binary data, big endian.
576  *                 Always fills the whole buffer, which will start with zeros
577  *                 if the number is smaller.
578  *
579  * \param X        The source MPI. This must point to an initialized MPI.
580  * \param buf      The output buffer. This must be a writable buffer of length
581  *                 \p buflen Bytes.
582  * \param buflen   The size of the output buffer \p buf in Bytes.
583  *
584  * \return         \c 0 if successful.
585  * \return         #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't
586  *                 large enough to hold the value of \p X.
587  * \return         Another negative error code on different kinds of failure.
588  */
589 int mbedtls_mpi_write_binary(const mbedtls_mpi *X, unsigned char *buf,
590                              size_t buflen);
591 
592 /**
593  * \brief          Export X into unsigned binary data, little endian.
594  *                 Always fills the whole buffer, which will end with zeros
595  *                 if the number is smaller.
596  *
597  * \param X        The source MPI. This must point to an initialized MPI.
598  * \param buf      The output buffer. This must be a writable buffer of length
599  *                 \p buflen Bytes.
600  * \param buflen   The size of the output buffer \p buf in Bytes.
601  *
602  * \return         \c 0 if successful.
603  * \return         #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't
604  *                 large enough to hold the value of \p X.
605  * \return         Another negative error code on different kinds of failure.
606  */
607 int mbedtls_mpi_write_binary_le(const mbedtls_mpi *X,
608                                 unsigned char *buf, size_t buflen);
609 
610 /**
611  * \brief          Perform a left-shift on an MPI: X <<= count
612  *
613  * \param X        The MPI to shift. This must point to an initialized MPI.
614  *                 The MPI pointed by \p X may be resized to fit
615  *                 the resulting number.
616  * \param count    The number of bits to shift by.
617  *
618  * \return         \c 0 if successful.
619  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
620  * \return         Another negative error code on different kinds of failure.
621  */
622 int mbedtls_mpi_shift_l(mbedtls_mpi *X, size_t count);
623 
624 /**
625  * \brief          Perform a right-shift on an MPI: X >>= count
626  *
627  * \param X        The MPI to shift. This must point to an initialized MPI.
628  * \param count    The number of bits to shift by.
629  *
630  * \return         \c 0 if successful.
631  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
632  * \return         Another negative error code on different kinds of failure.
633  */
634 int mbedtls_mpi_shift_r(mbedtls_mpi *X, size_t count);
635 
636 /**
637  * \brief          Compare the absolute values of two MPIs.
638  *
639  * \param X        The left-hand MPI. This must point to an initialized MPI.
640  * \param Y        The right-hand MPI. This must point to an initialized MPI.
641  *
642  * \return         \c 1 if `|X|` is greater than `|Y|`.
643  * \return         \c -1 if `|X|` is lesser than `|Y|`.
644  * \return         \c 0 if `|X|` is equal to `|Y|`.
645  */
646 int mbedtls_mpi_cmp_abs(const mbedtls_mpi *X, const mbedtls_mpi *Y);
647 
648 /**
649  * \brief          Compare two MPIs.
650  *
651  * \param X        The left-hand MPI. This must point to an initialized MPI.
652  * \param Y        The right-hand MPI. This must point to an initialized MPI.
653  *
654  * \return         \c 1 if \p X is greater than \p Y.
655  * \return         \c -1 if \p X is lesser than \p Y.
656  * \return         \c 0 if \p X is equal to \p Y.
657  */
658 int mbedtls_mpi_cmp_mpi(const mbedtls_mpi *X, const mbedtls_mpi *Y);
659 
660 /**
661  * \brief          Check if an MPI is less than the other in constant time.
662  *
663  * \param X        The left-hand MPI. This must point to an initialized MPI
664  *                 with the same allocated length as Y.
665  * \param Y        The right-hand MPI. This must point to an initialized MPI
666  *                 with the same allocated length as X.
667  * \param ret      The result of the comparison:
668  *                 \c 1 if \p X is less than \p Y.
669  *                 \c 0 if \p X is greater than or equal to \p Y.
670  *
671  * \return         0 on success.
672  * \return         MBEDTLS_ERR_MPI_BAD_INPUT_DATA if the allocated length of
673  *                 the two input MPIs is not the same.
674  */
675 int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X, const mbedtls_mpi *Y,
676                           unsigned *ret);
677 
678 /**
679  * \brief          Compare an MPI with an integer.
680  *
681  * \param X        The left-hand MPI. This must point to an initialized MPI.
682  * \param z        The integer value to compare \p X to.
683  *
684  * \return         \c 1 if \p X is greater than \p z.
685  * \return         \c -1 if \p X is lesser than \p z.
686  * \return         \c 0 if \p X is equal to \p z.
687  */
688 int mbedtls_mpi_cmp_int(const mbedtls_mpi *X, mbedtls_mpi_sint z);
689 
690 /**
691  * \brief          Perform an unsigned addition of MPIs: X = |A| + |B|
692  *
693  * \param X        The destination MPI. This must point to an initialized MPI.
694  * \param A        The first summand. This must point to an initialized MPI.
695  * \param B        The second summand. This must point to an initialized MPI.
696  *
697  * \return         \c 0 if successful.
698  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
699  * \return         Another negative error code on different kinds of failure.
700  */
701 int mbedtls_mpi_add_abs(mbedtls_mpi *X, const mbedtls_mpi *A,
702                         const mbedtls_mpi *B);
703 
704 /**
705  * \brief          Perform an unsigned subtraction of MPIs: X = |A| - |B|
706  *
707  * \param X        The destination MPI. This must point to an initialized MPI.
708  * \param A        The minuend. This must point to an initialized MPI.
709  * \param B        The subtrahend. This must point to an initialized MPI.
710  *
711  * \return         \c 0 if successful.
712  * \return         #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is greater than \p A.
713  * \return         Another negative error code on different kinds of failure.
714  *
715  */
716 int mbedtls_mpi_sub_abs(mbedtls_mpi *X, const mbedtls_mpi *A,
717                         const mbedtls_mpi *B);
718 
719 /**
720  * \brief          Perform a signed addition of MPIs: X = A + B
721  *
722  * \param X        The destination MPI. This must point to an initialized MPI.
723  * \param A        The first summand. This must point to an initialized MPI.
724  * \param B        The second summand. This must point to an initialized MPI.
725  *
726  * \return         \c 0 if successful.
727  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
728  * \return         Another negative error code on different kinds of failure.
729  */
730 int mbedtls_mpi_add_mpi(mbedtls_mpi *X, const mbedtls_mpi *A,
731                         const mbedtls_mpi *B);
732 
733 /**
734  * \brief          Perform a signed subtraction of MPIs: X = A - B
735  *
736  * \param X        The destination MPI. This must point to an initialized MPI.
737  * \param A        The minuend. This must point to an initialized MPI.
738  * \param B        The subtrahend. This must point to an initialized MPI.
739  *
740  * \return         \c 0 if successful.
741  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
742  * \return         Another negative error code on different kinds of failure.
743  */
744 int mbedtls_mpi_sub_mpi(mbedtls_mpi *X, const mbedtls_mpi *A,
745                         const mbedtls_mpi *B);
746 
747 /**
748  * \brief          Perform a signed addition of an MPI and an integer: X = A + b
749  *
750  * \param X        The destination MPI. This must point to an initialized MPI.
751  * \param A        The first summand. This must point to an initialized MPI.
752  * \param b        The second summand.
753  *
754  * \return         \c 0 if successful.
755  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
756  * \return         Another negative error code on different kinds of failure.
757  */
758 int mbedtls_mpi_add_int(mbedtls_mpi *X, const mbedtls_mpi *A,
759                         mbedtls_mpi_sint b);
760 
761 /**
762  * \brief          Perform a signed subtraction of an MPI and an integer:
763  *                 X = A - b
764  *
765  * \param X        The destination MPI. This must point to an initialized MPI.
766  * \param A        The minuend. This must point to an initialized MPI.
767  * \param b        The subtrahend.
768  *
769  * \return         \c 0 if successful.
770  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
771  * \return         Another negative error code on different kinds of failure.
772  */
773 int mbedtls_mpi_sub_int(mbedtls_mpi *X, const mbedtls_mpi *A,
774                         mbedtls_mpi_sint b);
775 
776 /**
777  * \brief          Perform a multiplication of two MPIs: X = A * B
778  *
779  * \param X        The destination MPI. This must point to an initialized MPI.
780  * \param A        The first factor. This must point to an initialized MPI.
781  * \param B        The second factor. This must point to an initialized MPI.
782  *
783  * \return         \c 0 if successful.
784  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
785  * \return         Another negative error code on different kinds of failure.
786  *
787  */
788 int mbedtls_mpi_mul_mpi(mbedtls_mpi *X, const mbedtls_mpi *A,
789                         const mbedtls_mpi *B);
790 
791 /**
792  * \brief          Perform a multiplication of an MPI with an unsigned integer:
793  *                 X = A * b
794  *
795  * \param X        The destination MPI. This must point to an initialized MPI.
796  * \param A        The first factor. This must point to an initialized MPI.
797  * \param b        The second factor.
798  *
799  * \return         \c 0 if successful.
800  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
801  * \return         Another negative error code on different kinds of failure.
802  *
803  */
804 int mbedtls_mpi_mul_int(mbedtls_mpi *X, const mbedtls_mpi *A,
805                         mbedtls_mpi_uint b);
806 
807 /**
808  * \brief          Perform a division with remainder of two MPIs:
809  *                 A = Q * B + R
810  *
811  * \param Q        The destination MPI for the quotient.
812  *                 This may be \c NULL if the value of the
813  *                 quotient is not needed. This must not alias A or B.
814  * \param R        The destination MPI for the remainder value.
815  *                 This may be \c NULL if the value of the
816  *                 remainder is not needed. This must not alias A or B.
817  * \param A        The dividend. This must point to an initialized MPI.
818  * \param B        The divisor. This must point to an initialized MPI.
819  *
820  * \return         \c 0 if successful.
821  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
822  * \return         #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero.
823  * \return         Another negative error code on different kinds of failure.
824  */
825 int mbedtls_mpi_div_mpi(mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A,
826                         const mbedtls_mpi *B);
827 
828 /**
829  * \brief          Perform a division with remainder of an MPI by an integer:
830  *                 A = Q * b + R
831  *
832  * \param Q        The destination MPI for the quotient.
833  *                 This may be \c NULL if the value of the
834  *                 quotient is not needed.  This must not alias A.
835  * \param R        The destination MPI for the remainder value.
836  *                 This may be \c NULL if the value of the
837  *                 remainder is not needed.  This must not alias A.
838  * \param A        The dividend. This must point to an initialized MPi.
839  * \param b        The divisor.
840  *
841  * \return         \c 0 if successful.
842  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
843  * \return         #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero.
844  * \return         Another negative error code on different kinds of failure.
845  */
846 int mbedtls_mpi_div_int(mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A,
847                         mbedtls_mpi_sint b);
848 
849 /**
850  * \brief          Perform a modular reduction. R = A mod B
851  *
852  * \param R        The destination MPI for the residue value.
853  *                 This must point to an initialized MPI.
854  * \param A        The MPI to compute the residue of.
855  *                 This must point to an initialized MPI.
856  * \param B        The base of the modular reduction.
857  *                 This must point to an initialized MPI.
858  *
859  * \return         \c 0 if successful.
860  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
861  * \return         #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero.
862  * \return         #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is negative.
863  * \return         Another negative error code on different kinds of failure.
864  *
865  */
866 int mbedtls_mpi_mod_mpi(mbedtls_mpi *R, const mbedtls_mpi *A,
867                         const mbedtls_mpi *B);
868 
869 /**
870  * \brief          Perform a modular reduction with respect to an integer.
871  *                 r = A mod b
872  *
873  * \param r        The address at which to store the residue.
874  *                 This must not be \c NULL.
875  * \param A        The MPI to compute the residue of.
876  *                 This must point to an initialized MPi.
877  * \param b        The integer base of the modular reduction.
878  *
879  * \return         \c 0 if successful.
880  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
881  * \return         #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero.
882  * \return         #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p b is negative.
883  * \return         Another negative error code on different kinds of failure.
884  */
885 int mbedtls_mpi_mod_int(mbedtls_mpi_uint *r, const mbedtls_mpi *A,
886                         mbedtls_mpi_sint b);
887 
888 /**
889  * \brief          Perform a modular exponentiation: X = A^E mod N
890  *
891  * \param X        The destination MPI. This must point to an initialized MPI.
892  *                 This must not alias E or N.
893  * \param A        The base of the exponentiation.
894  *                 This must point to an initialized MPI.
895  * \param E        The exponent MPI. This must point to an initialized MPI.
896  * \param N        The base for the modular reduction. This must point to an
897  *                 initialized MPI.
898  * \param prec_RR  A helper MPI depending solely on \p N which can be used to
899  *                 speed-up multiple modular exponentiations for the same value
900  *                 of \p N. This may be \c NULL. If it is not \c NULL, it must
901  *                 point to an initialized MPI. If it hasn't been used after
902  *                 the call to mbedtls_mpi_init(), this function will compute
903  *                 the helper value and store it in \p prec_RR for reuse on
904  *                 subsequent calls to this function. Otherwise, the function
905  *                 will assume that \p prec_RR holds the helper value set by a
906  *                 previous call to mbedtls_mpi_exp_mod(), and reuse it.
907  *
908  * \return         \c 0 if successful.
909  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
910  * \return         #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \c N is negative or
911  *                 even, or if \c E is negative.
912  * \return         Another negative error code on different kinds of failures.
913  *
914  */
915 int mbedtls_mpi_exp_mod(mbedtls_mpi *X, const mbedtls_mpi *A,
916                         const mbedtls_mpi *E, const mbedtls_mpi *N,
917                         mbedtls_mpi *prec_RR);
918 
919 /**
920  * \brief          Fill an MPI with a number of random bytes.
921  *
922  * \param X        The destination MPI. This must point to an initialized MPI.
923  * \param size     The number of random bytes to generate.
924  * \param f_rng    The RNG function to use. This must not be \c NULL.
925  * \param p_rng    The RNG parameter to be passed to \p f_rng. This may be
926  *                 \c NULL if \p f_rng doesn't need a context argument.
927  *
928  * \return         \c 0 if successful.
929  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
930  * \return         Another negative error code on failure.
931  *
932  * \note           The bytes obtained from the RNG are interpreted
933  *                 as a big-endian representation of an MPI; this can
934  *                 be relevant in applications like deterministic ECDSA.
935  */
936 int mbedtls_mpi_fill_random(mbedtls_mpi *X, size_t size,
937                             int (*f_rng)(void *, unsigned char *, size_t),
938                             void *p_rng);
939 
940 /** Generate a random number uniformly in a range.
941  *
942  * This function generates a random number between \p min inclusive and
943  * \p N exclusive.
944  *
945  * The procedure complies with RFC 6979 §3.3 (deterministic ECDSA)
946  * when the RNG is a suitably parametrized instance of HMAC_DRBG
947  * and \p min is \c 1.
948  *
949  * \note           There are `N - min` possible outputs. The lower bound
950  *                 \p min can be reached, but the upper bound \p N cannot.
951  *
952  * \param X        The destination MPI. This must point to an initialized MPI.
953  * \param min      The minimum value to return.
954  *                 It must be nonnegative.
955  * \param N        The upper bound of the range, exclusive.
956  *                 In other words, this is one plus the maximum value to return.
957  *                 \p N must be strictly larger than \p min.
958  * \param f_rng    The RNG function to use. This must not be \c NULL.
959  * \param p_rng    The RNG parameter to be passed to \p f_rng.
960  *
961  * \return         \c 0 if successful.
962  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
963  * \return         #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p min or \p N is invalid
964  *                 or if they are incompatible.
965  * \return         #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if the implementation was
966  *                 unable to find a suitable value within a limited number
967  *                 of attempts. This has a negligible probability if \p N
968  *                 is significantly larger than \p min, which is the case
969  *                 for all usual cryptographic applications.
970  * \return         Another negative error code on failure.
971  */
972 int mbedtls_mpi_random(mbedtls_mpi *X,
973                        mbedtls_mpi_sint min,
974                        const mbedtls_mpi *N,
975                        int (*f_rng)(void *, unsigned char *, size_t),
976                        void *p_rng);
977 
978 /**
979  * \brief          Compute the greatest common divisor: G = gcd(A, B)
980  *
981  * \param G        The destination MPI. This must point to an initialized MPI.
982  * \param A        The first operand. This must point to an initialized MPI.
983  * \param B        The second operand. This must point to an initialized MPI.
984  *
985  * \return         \c 0 if successful.
986  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
987  * \return         Another negative error code on different kinds of failure.
988  */
989 int mbedtls_mpi_gcd(mbedtls_mpi *G, const mbedtls_mpi *A,
990                     const mbedtls_mpi *B);
991 
992 /**
993  * \brief          Compute the modular inverse: X = A^-1 mod N
994  *
995  * \param X        The destination MPI. This must point to an initialized MPI.
996  * \param A        The MPI to calculate the modular inverse of. This must point
997  *                 to an initialized MPI.
998  * \param N        The base of the modular inversion. This must point to an
999  *                 initialized MPI.
1000  *
1001  * \return         \c 0 if successful.
1002  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
1003  * \return         #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than
1004  *                 or equal to one.
1005  * \return         #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular
1006  *                 inverse with respect to \p N.
1007  */
1008 int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A,
1009                         const mbedtls_mpi *N);
1010 
1011 /**
1012  * \brief          Miller-Rabin primality test.
1013  *
1014  * \warning        If \p X is potentially generated by an adversary, for example
1015  *                 when validating cryptographic parameters that you didn't
1016  *                 generate yourself and that are supposed to be prime, then
1017  *                 \p rounds should be at least the half of the security
1018  *                 strength of the cryptographic algorithm. On the other hand,
1019  *                 if \p X is chosen uniformly or non-adversarially (as is the
1020  *                 case when mbedtls_mpi_gen_prime calls this function), then
1021  *                 \p rounds can be much lower.
1022  *
1023  * \param X        The MPI to check for primality.
1024  *                 This must point to an initialized MPI.
1025  * \param rounds   The number of bases to perform the Miller-Rabin primality
1026  *                 test for. The probability of returning 0 on a composite is
1027  *                 at most 2<sup>-2*\p rounds </sup>.
1028  * \param f_rng    The RNG function to use. This must not be \c NULL.
1029  * \param p_rng    The RNG parameter to be passed to \p f_rng.
1030  *                 This may be \c NULL if \p f_rng doesn't use
1031  *                 a context parameter.
1032  *
1033  * \return         \c 0 if successful, i.e. \p X is probably prime.
1034  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
1035  * \return         #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p X is not prime.
1036  * \return         Another negative error code on other kinds of failure.
1037  */
1038 int mbedtls_mpi_is_prime_ext(const mbedtls_mpi *X, int rounds,
1039                              int (*f_rng)(void *, unsigned char *, size_t),
1040                              void *p_rng);
1041 /**
1042  * \brief Flags for mbedtls_mpi_gen_prime()
1043  *
1044  * Each of these flags is a constraint on the result X returned by
1045  * mbedtls_mpi_gen_prime().
1046  */
1047 typedef enum {
1048     MBEDTLS_MPI_GEN_PRIME_FLAG_DH =      0x0001, /**< (X-1)/2 is prime too */
1049     MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR = 0x0002, /**< lower error rate from 2<sup>-80</sup> to 2<sup>-128</sup> */
1050 } mbedtls_mpi_gen_prime_flag_t;
1051 
1052 /**
1053  * \brief          Generate a prime number.
1054  *
1055  * \param X        The destination MPI to store the generated prime in.
1056  *                 This must point to an initialized MPi.
1057  * \param nbits    The required size of the destination MPI in bits.
1058  *                 This must be between \c 3 and #MBEDTLS_MPI_MAX_BITS.
1059  * \param flags    A mask of flags of type #mbedtls_mpi_gen_prime_flag_t.
1060  * \param f_rng    The RNG function to use. This must not be \c NULL.
1061  * \param p_rng    The RNG parameter to be passed to \p f_rng.
1062  *                 This may be \c NULL if \p f_rng doesn't use
1063  *                 a context parameter.
1064  *
1065  * \return         \c 0 if successful, in which case \p X holds a
1066  *                 probably prime number.
1067  * \return         #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed.
1068  * \return         #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if `nbits` is not between
1069  *                 \c 3 and #MBEDTLS_MPI_MAX_BITS.
1070  */
1071 int mbedtls_mpi_gen_prime(mbedtls_mpi *X, size_t nbits, int flags,
1072                           int (*f_rng)(void *, unsigned char *, size_t),
1073                           void *p_rng);
1074 
1075 /**
1076  * \brief          Montgomery initialization
1077  *
1078  * \param mm       The -1/m mod N result
1079  * \param N        The modulus
1080  */
1081 void mbedtls_mpi_montg_init( mbedtls_mpi_uint *mm, const mbedtls_mpi *N );
1082 
1083 /**
1084  * \brief          Montgomery multiplication: A = A * B * R^-1 mod N
1085  * \A              Parameter and result
1086  * \B              Parameter
1087  * \N              Modulus
1088  * \mm             Parameter from mbedtls_mpi_montg_init()
1089  * \T              Temporary variable, should be as twice as big as N + 2
1090  */
1091 void mbedtls_mpi_montmul(mbedtls_mpi *A, const mbedtls_mpi *B,
1092                          const mbedtls_mpi *N, mbedtls_mpi_uint mm,
1093                          mbedtls_mpi *T );
1094 
1095 /**
1096  * \brief          Montgomery reduction: A = A * R^-1 mod N
1097  * \A              Parameter and result
1098  * \N              Modulus
1099  * \mm             Parameter from mbedtls_mpi_montg_init()
1100  * \T              Temporary variable, should be as twice as big as N + 2
1101  */
1102 void mbedtls_mpi_montred(mbedtls_mpi *A, const mbedtls_mpi *N,
1103                          mbedtls_mpi_uint mm, mbedtls_mpi *T);
1104 
1105 #if defined(MBEDTLS_SELF_TEST)
1106 
1107 /**
1108  * \brief          Checkup routine
1109  *
1110  * \return         0 if successful, or 1 if the test failed
1111  */
1112 int mbedtls_mpi_self_test(int verbose);
1113 
1114 #endif /* MBEDTLS_SELF_TEST */
1115 
1116 #ifdef __cplusplus
1117 }
1118 #endif
1119 
1120 #endif /* bignum.h */
1121