grpc 1.0.1 → 1.1.2

data/third_party/boringssl/crypto/bn/exponentiation.c

@@ -209,6 +209,7 @@ static void BN_RECP_CTX_init(BN_RECP_CTX *recp) {
   BN_init(&recp->N);
   BN_init(&recp->Nr);
   recp->num_bits = 0;
+  recp->shift = 0;
   recp->flags = 0;
 }
 
@@ -575,41 +576,7 @@ err:
 
 int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
                BN_CTX *ctx) {
-  /* For even modulus  m = 2^k*m_odd,  it might make sense to compute
-   * a^p mod m_odd  and  a^p mod 2^k  separately (with Montgomery
-   * exponentiation for the odd part), using appropriate exponent
-   * reductions, and combine the results using the CRT.
-   *
-   * For now, we use Montgomery only if the modulus is odd; otherwise,
-   * exponentiation using the reciprocal-based quick remaindering
-   * algorithm is used.
-   *
-   * (Timing obtained with expspeed.c [computations  a^p mod m
-   * where  a, p, m  are of the same length: 256, 512, 1024, 2048,
-   * 4096, 8192 bits], compared to the running time of the
-   * standard algorithm:
-   *
-   *   BN_mod_exp_mont   33 .. 40 %  [AMD K6-2, Linux, debug configuration]
-   *                     55 .. 77 %  [UltraSparc processor, but
-   *                                  debug-solaris-sparcv8-gcc conf.]
-   *
-   *   BN_mod_exp_recp   50 .. 70 %  [AMD K6-2, Linux, debug configuration]
-   *                     62 .. 118 % [UltraSparc, debug-solaris-sparcv8-gcc]
-   *
-   * On the Sparc, BN_mod_exp_recp was faster than BN_mod_exp_mont
-   * at 2048 and more bits, but at 512 and 1024 bits, it was
-   * slower even than the standard algorithm!
-   *
-   * "Real" timings [linux-elf, solaris-sparcv9-gcc configurations]
-   * should be obtained when the new Montgomery reduction code
-   * has been integrated into OpenSSL.) */
-
   if (BN_is_odd(m)) {
-    if (a->top == 1 && !a->neg && BN_get_flags(p, BN_FLG_CONSTTIME) == 0) {
-      BN_ULONG A = a->d[0];
-      return BN_mod_exp_mont_word(r, A, p, m, ctx, NULL);
-    }
-
     return BN_mod_exp_mont(r, a, p, m, ctx, NULL);
   }
 
@@ -787,29 +754,65 @@ err:
  * pattern as far as cache lines are concerned. The following functions are
  * used to transfer a BIGNUM from/to that table. */
 static int copy_to_prebuf(const BIGNUM *b, int top, unsigned char *buf, int idx,
-                          int width) {
-  size_t i, j;
+                          int window) {
+  int i, j;
+  const int width = 1 << window;
+  BN_ULONG *table = (BN_ULONG *) buf;
 
   if (top > b->top) {
     top = b->top; /* this works because 'buf' is explicitly zeroed */
   }
-  for (i = 0, j = idx; i < top * sizeof b->d[0]; i++, j += width) {
-    buf[j] = ((unsigned char *)b->d)[i];
+
+  for (i = 0, j = idx; i < top; i++, j += width)  {
+    table[j] = b->d[i];
   }
 
   return 1;
 }
 
 static int copy_from_prebuf(BIGNUM *b, int top, unsigned char *buf, int idx,
-                            int width) {
-  size_t i, j;
+                            int window) {
+  int i, j;
+  const int width = 1 << window;
+  volatile BN_ULONG *table = (volatile BN_ULONG *)buf;
 
   if (bn_wexpand(b, top) == NULL) {
     return 0;
   }
 
-  for (i = 0, j = idx; i < top * sizeof b->d[0]; i++, j += width) {
-    ((unsigned char *)b->d)[i] = buf[j];
+  if (window <= 3) {
+    for (i = 0; i < top; i++, table += width) {
+      BN_ULONG acc = 0;
+
+      for (j = 0; j < width; j++) {
+        acc |= table[j] & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
+      }
+
+      b->d[i] = acc;
+    }
+  } else {
+    int xstride = 1 << (window - 2);
+    BN_ULONG y0, y1, y2, y3;
+
+    i = idx >> (window - 2); /* equivalent of idx / xstride */
+    idx &= xstride - 1;      /* equivalent of idx % xstride */
+
+    y0 = (BN_ULONG)0 - (constant_time_eq_int(i, 0) & 1);
+    y1 = (BN_ULONG)0 - (constant_time_eq_int(i, 1) & 1);
+    y2 = (BN_ULONG)0 - (constant_time_eq_int(i, 2) & 1);
+    y3 = (BN_ULONG)0 - (constant_time_eq_int(i, 3) & 1);
+
+    for (i = 0; i < top; i++, table += width) {
+      BN_ULONG acc = 0;
+
+      for (j = 0; j < xstride; j++) {
+        acc |= ((table[j + 0 * xstride] & y0) | (table[j + 1 * xstride] & y1) |
+                (table[j + 2 * xstride] & y2) | (table[j + 3 * xstride] & y3)) &
+               ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
+      }
+
+      b->d[i] = acc;
+    }
   }
 
   b->top = top;
@@ -891,8 +894,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     return BN_one(rr);
   }
 
-  BN_CTX_start(ctx);
-
   /* Allocate a montgomery context if it was not supplied by the caller. */
   if (mont == NULL) {
     new_mont = BN_MONT_CTX_new();
@@ -935,9 +936,8 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 #if defined(OPENSSL_BN_ASM_MONT5)
   if (window >= 5) {
     window = 5; /* ~5% improvement for RSA2048 sign, and even for RSA4096 */
-    if ((top & 7) == 0) {
-      powerbufLen += 2 * top * sizeof(m->d[0]);
-    }
+    /* reserve space for mont->N.d[] copy */
+    powerbufLen += top * sizeof(mont->N.d[0]);
   }
 #endif
 
@@ -992,7 +992,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
   /* prepare a^1 in Montgomery domain */
   if (a->neg || BN_ucmp(a, m) >= 0) {
-    if (!BN_mod(&am, a, m, ctx) ||
+    if (!BN_nnmod(&am, a, m, ctx) ||
         !BN_to_montgomery(&am, &am, mont, ctx)) {
       goto err;
     }
@@ -1008,7 +1008,8 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   /* Dedicated window==4 case improves 512-bit RSA sign by ~15%, but as
    * 512-bit RSA is hardly relevant, we omit it to spare size... */
   if (window == 5 && top > 1) {
-    const BN_ULONG *np = mont->N.d, *n0 = mont->n0, *np2;
+    const BN_ULONG *n0 = mont->n0;
+    BN_ULONG *np;
 
     /* BN_to_montgomery can contaminate words above .top
      * [in BN_DEBUG[_DEBUG] build]... */
@@ -1019,14 +1020,9 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
       tmp.d[i] = 0;
     }
 
-    if (top & 7) {
-      np2 = np;
-    } else {
-      BN_ULONG *np_double = am.d + top;
-      for (i = 0; i < top; i++) {
-        np_double[2 * i] = np[i];
-      }
-      np2 = np_double;
+    /* copy mont->N.d[] to improve cache locality */
+    for (np = am.d + top, i = 0; i < top; i++) {
+      np[i] = mont->N.d[i];
     }
 
     bn_scatter5(tmp.d, top, powerbuf, 0);
@@ -1041,7 +1037,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     }
     for (i = 3; i < 8; i += 2) {
       int j;
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np2, n0, top, i - 1);
+      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
       bn_scatter5(tmp.d, top, powerbuf, i);
       for (j = 2 * i; j < 32; j *= 2) {
         bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
@@ -1049,13 +1045,13 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
       }
     }
     for (; i < 16; i += 2) {
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np2, n0, top, i - 1);
+      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
       bn_scatter5(tmp.d, top, powerbuf, i);
       bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
       bn_scatter5(tmp.d, top, powerbuf, 2 * i);
     }
     for (; i < 32; i += 2) {
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np2, n0, top, i - 1);
+      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
       bn_scatter5(tmp.d, top, powerbuf, i);
     }
 
@@ -1103,7 +1099,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         wvalue >>= (bits - 4) & 7;
         wvalue &= 0x1f;
         bits -= 5;
-        bn_power5(tmp.d, tmp.d, powerbuf, np2, n0, top, wvalue);
+        bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, wvalue);
       }
       while (bits >= 0) {
         /* Read five bits from |bits-4| through |bits|, inclusive. */
@@ -1112,11 +1108,11 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         wvalue >>= first_bit & 7;
         wvalue &= 0x1f;
         bits -= 5;
-        bn_power5(tmp.d, tmp.d, powerbuf, np2, n0, top, wvalue);
+        bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, wvalue);
       }
     }
 
-    ret = bn_from_montgomery(tmp.d, tmp.d, NULL, np2, n0, top);
+    ret = bn_from_montgomery(tmp.d, tmp.d, NULL, np, n0, top);
     tmp.top = top;
     bn_correct_top(&tmp);
     if (ret) {
@@ -1128,8 +1124,8 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   } else
 #endif
   {
-    if (!copy_to_prebuf(&tmp, top, powerbuf, 0, numPowers) ||
-        !copy_to_prebuf(&am, top, powerbuf, 1, numPowers)) {
+    if (!copy_to_prebuf(&tmp, top, powerbuf, 0, window) ||
+        !copy_to_prebuf(&am, top, powerbuf, 1, window)) {
       goto err;
     }
 
@@ -1140,13 +1136,13 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
      */
     if (window > 1) {
       if (!BN_mod_mul_montgomery(&tmp, &am, &am, mont, ctx) ||
-          !copy_to_prebuf(&tmp, top, powerbuf, 2, numPowers)) {
+          !copy_to_prebuf(&tmp, top, powerbuf, 2, window)) {
         goto err;
       }
       for (i = 3; i < numPowers; i++) {
         /* Calculate a^i = a^(i-1) * a */
         if (!BN_mod_mul_montgomery(&tmp, &am, &tmp, mont, ctx) ||
-            !copy_to_prebuf(&tmp, top, powerbuf, i, numPowers)) {
+            !copy_to_prebuf(&tmp, top, powerbuf, i, window)) {
           goto err;
         }
       }
@@ -1156,7 +1152,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     for (wvalue = 0, i = bits % window; i >= 0; i--, bits--) {
       wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);
     }
-    if (!copy_from_prebuf(&tmp, top, powerbuf, wvalue, numPowers)) {
+    if (!copy_from_prebuf(&tmp, top, powerbuf, wvalue, window)) {
       goto err;
     }
 
@@ -1175,7 +1171,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
       }
 
       /* Fetch the appropriate pre-computed value from the pre-buf */
-      if (!copy_from_prebuf(&am, top, powerbuf, wvalue, numPowers)) {
+      if (!copy_from_prebuf(&am, top, powerbuf, wvalue, window)) {
         goto err;
       }
 
@@ -1198,158 +1194,27 @@ err:
     OPENSSL_cleanse(powerbuf, powerbufLen);
     OPENSSL_free(powerbufFree);
   }
-  BN_CTX_end(ctx);
   return (ret);
 }
 
 int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
                          const BIGNUM *m, BN_CTX *ctx,
                          const BN_MONT_CTX *mont) {
-  BN_MONT_CTX *new_mont = NULL;
-  int b, bits, ret = 0;
-  int r_is_one;
-  BN_ULONG w, next_w;
-  BIGNUM *d, *r, *t;
-  BIGNUM *swap_tmp;
-#define BN_MOD_MUL_WORD(r, w, m)   \
-  (BN_mul_word(r, (w)) &&          \
-   (/* BN_ucmp(r, (m)) < 0 ? 1 :*/ \
-    (BN_mod(t, r, m, ctx) && (swap_tmp = r, r = t, t = swap_tmp, 1))))
-  /* BN_MOD_MUL_WORD is only used with 'w' large, so the BN_ucmp test is
-   * probably more overhead than always using BN_mod (which uses BN_copy if a
-   * similar test returns true). We can use BN_mod and do not need BN_nnmod
-   * because our accumulator is never negative (the result of BN_mod does not
-   * depend on the sign of the modulus). */
-#define BN_TO_MONTGOMERY_WORD(r, w, mont) \
-  (BN_set_word(r, (w)) && BN_to_montgomery(r, r, (mont), ctx))
-
-  if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0) {
-    /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
-    OPENSSL_PUT_ERROR(BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    return 0;
-  }
-
-  if (!BN_is_odd(m)) {
-    OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
-    return 0;
-  }
+  BIGNUM a_bignum;
+  BN_init(&a_bignum);
 
-  if (m->top == 1) {
-    a %= m->d[0]; /* make sure that 'a' is reduced */
-  }
-
-  bits = BN_num_bits(p);
-  if (bits == 0) {
-    /* x**0 mod 1 is still zero. */
-    if (BN_is_one(m)) {
-      BN_zero(rr);
-      return 1;
-    }
-    return BN_one(rr);
-  }
-  if (a == 0) {
-    BN_zero(rr);
-    return 1;
-  }
+  int ret = 0;
 
-  BN_CTX_start(ctx);
-  d = BN_CTX_get(ctx);
-  r = BN_CTX_get(ctx);
-  t = BN_CTX_get(ctx);
-  if (d == NULL || r == NULL || t == NULL) {
+  if (!BN_set_word(&a_bignum, a)) {
+    OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR);
     goto err;
   }
 
-  /* Allocate a montgomery context if it was not supplied by the caller. */
-  if (mont == NULL) {
-    new_mont = BN_MONT_CTX_new();
-    if (new_mont == NULL || !BN_MONT_CTX_set(new_mont, m, ctx)) {
-      goto err;
-    }
-    mont = new_mont;
-  }
-
-  r_is_one = 1; /* except for Montgomery factor */
-
-  /* bits-1 >= 0 */
-
-  /* The result is accumulated in the product r*w. */
-  w = a; /* bit 'bits-1' of 'p' is always set */
-  for (b = bits - 2; b >= 0; b--) {
-    /* First, square r*w. */
-    next_w = w * w;
-    if ((next_w / w) != w) {
-      /* overflow */
-      if (r_is_one) {
-        if (!BN_TO_MONTGOMERY_WORD(r, w, mont)) {
-          goto err;
-        }
-        r_is_one = 0;
-      } else {
-        if (!BN_MOD_MUL_WORD(r, w, m)) {
-          goto err;
-        }
-      }
-      next_w = 1;
-    }
-
-    w = next_w;
-    if (!r_is_one) {
-      if (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) {
-        goto err;
-      }
-    }
-
-    /* Second, multiply r*w by 'a' if exponent bit is set. */
-    if (BN_is_bit_set(p, b)) {
-      next_w = w * a;
-      if ((next_w / a) != w) {
-        /* overflow */
-        if (r_is_one) {
-          if (!BN_TO_MONTGOMERY_WORD(r, w, mont)) {
-            goto err;
-          }
-          r_is_one = 0;
-        } else {
-          if (!BN_MOD_MUL_WORD(r, w, m)) {
-            goto err;
-          }
-        }
-        next_w = a;
-      }
-      w = next_w;
-    }
-  }
-
-  /* Finally, set r:=r*w. */
-  if (w != 1) {
-    if (r_is_one) {
-      if (!BN_TO_MONTGOMERY_WORD(r, w, mont)) {
-        goto err;
-      }
-      r_is_one = 0;
-    } else {
-      if (!BN_MOD_MUL_WORD(r, w, m)) {
-        goto err;
-      }
-    }
-  }
-
-  if (r_is_one) {
-    /* can happen only if a == 1*/
-    if (!BN_one(rr)) {
-      goto err;
-    }
-  } else {
-    if (!BN_from_montgomery(rr, r, mont, ctx)) {
-      goto err;
-    }
-  }
-  ret = 1;
+  ret = BN_mod_exp_mont(rr, &a_bignum, p, m, ctx, mont);
 
 err:
-  BN_MONT_CTX_free(new_mont);
-  BN_CTX_end(ctx);
+  BN_free(&a_bignum);
+
   return ret;
 }
 
@@ -1358,36 +1223,11 @@ err:
 int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
                      const BIGNUM *a2, const BIGNUM *p2, const BIGNUM *m,
                      BN_CTX *ctx, const BN_MONT_CTX *mont) {
-  int i, j, bits, b, bits1, bits2, ret = 0, wpos1, wpos2, window1, window2,
-                                   wvalue1, wvalue2;
-  int r_is_one = 1;
-  BIGNUM *d, *r;
-  const BIGNUM *a_mod_m;
-  /* Tables of variables obtained from 'ctx' */
-  BIGNUM *val1[TABLE_SIZE], *val2[TABLE_SIZE];
-  BN_MONT_CTX *new_mont = NULL;
-
-  if (!(m->d[0] & 1)) {
-    OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
-    return 0;
-  }
-  bits1 = BN_num_bits(p1);
-  bits2 = BN_num_bits(p2);
-  if (bits1 == 0 && bits2 == 0) {
-    ret = BN_one(rr);
-    return ret;
-  }
-
-  bits = (bits1 > bits2) ? bits1 : bits2;
+  BIGNUM tmp;
+  BN_init(&tmp);
 
-  BN_CTX_start(ctx);
-  d = BN_CTX_get(ctx);
-  r = BN_CTX_get(ctx);
-  val1[0] = BN_CTX_get(ctx);
-  val2[0] = BN_CTX_get(ctx);
-  if (!d || !r || !val1[0] || !val2[0]) {
-    goto err;
-  }
+  int ret = 0;
+  BN_MONT_CTX *new_mont = NULL;
 
   /* Allocate a montgomery context if it was not supplied by the caller. */
   if (mont == NULL) {
@@ -1398,156 +1238,21 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
     mont = new_mont;
   }
 
-  window1 = BN_window_bits_for_exponent_size(bits1);
-  window2 = BN_window_bits_for_exponent_size(bits2);
-
-  /* Build table for a1:   val1[i] := a1^(2*i + 1) mod m  for i = 0 ..
-   * 2^(window1-1) */
-  if (a1->neg || BN_ucmp(a1, m) >= 0) {
-    if (!BN_mod(val1[0], a1, m, ctx)) {
-      goto err;
-    }
-    a_mod_m = val1[0];
-  } else {
-    a_mod_m = a1;
-  }
-
-  if (BN_is_zero(a_mod_m)) {
-    BN_zero(rr);
-    ret = 1;
-    goto err;
-  }
-
-  if (!BN_to_montgomery(val1[0], a_mod_m, mont, ctx)) {
+  /* BN_mod_mul_montgomery removes one Montgomery factor, so passing one
+   * Montgomery-encoded and one non-Montgomery-encoded value gives a
+   * non-Montgomery-encoded result. */
+  if (!BN_mod_exp_mont(rr, a1, p1, m, ctx, mont) ||
+      !BN_mod_exp_mont(&tmp, a2, p2, m, ctx, mont) ||
+      !BN_to_montgomery(rr, rr, mont, ctx) ||
+      !BN_mod_mul_montgomery(rr, rr, &tmp, mont, ctx)) {
     goto err;
   }
 
-  if (window1 > 1) {
-    if (!BN_mod_mul_montgomery(d, val1[0], val1[0], mont, ctx)) {
-      goto err;
-    }
-
-    j = 1 << (window1 - 1);
-    for (i = 1; i < j; i++) {
-      if (((val1[i] = BN_CTX_get(ctx)) == NULL) ||
-          !BN_mod_mul_montgomery(val1[i], val1[i - 1], d, mont, ctx)) {
-        goto err;
-      }
-    }
-  }
-
-  /* Build table for a2:   val2[i] := a2^(2*i + 1) mod m  for i = 0 ..
-   * 2^(window2-1) */
-  if (a2->neg || BN_ucmp(a2, m) >= 0) {
-    if (!BN_mod(val2[0], a2, m, ctx)) {
-      goto err;
-    }
-    a_mod_m = val2[0];
-  } else {
-    a_mod_m = a2;
-  }
-
-  if (BN_is_zero(a_mod_m)) {
-    BN_zero(rr);
-    ret = 1;
-    goto err;
-  }
-
-  if (!BN_to_montgomery(val2[0], a_mod_m, mont, ctx)) {
-    goto err;
-  }
-
-  if (window2 > 1) {
-    if (!BN_mod_mul_montgomery(d, val2[0], val2[0], mont, ctx)) {
-      goto err;
-    }
-
-    j = 1 << (window2 - 1);
-    for (i = 1; i < j; i++) {
-      if (((val2[i] = BN_CTX_get(ctx)) == NULL) ||
-          !BN_mod_mul_montgomery(val2[i], val2[i - 1], d, mont, ctx)) {
-        goto err;
-      }
-    }
-  }
-
-  /* Now compute the power product, using independent windows. */
-  r_is_one = 1;
-  wvalue1 = 0; /* The 'value' of the first window */
-  wvalue2 = 0; /* The 'value' of the second window */
-  wpos1 = 0;   /* If wvalue1 > 0, the bottom bit of the first window */
-  wpos2 = 0;   /* If wvalue2 > 0, the bottom bit of the second window */
-
-  if (!BN_to_montgomery(r, BN_value_one(), mont, ctx)) {
-    goto err;
-  }
-
-  for (b = bits - 1; b >= 0; b--) {
-    if (!r_is_one) {
-      if (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) {
-        goto err;
-      }
-    }
-
-    if (!wvalue1 && BN_is_bit_set(p1, b)) {
-      /* consider bits b-window1+1 .. b for this window */
-      i = b - window1 + 1;
-      /* works for i<0 */
-      while (!BN_is_bit_set(p1, i)) {
-        i++;
-      }
-      wpos1 = i;
-      wvalue1 = 1;
-      for (i = b - 1; i >= wpos1; i--) {
-        wvalue1 <<= 1;
-        if (BN_is_bit_set(p1, i)) {
-          wvalue1++;
-        }
-      }
-    }
-
-    if (!wvalue2 && BN_is_bit_set(p2, b)) {
-      /* consider bits b-window2+1 .. b for this window */
-      i = b - window2 + 1;
-      while (!BN_is_bit_set(p2, i)) {
-        i++;
-      }
-      wpos2 = i;
-      wvalue2 = 1;
-      for (i = b - 1; i >= wpos2; i--) {
-        wvalue2 <<= 1;
-        if (BN_is_bit_set(p2, i)) {
-          wvalue2++;
-        }
-      }
-    }
-
-    if (wvalue1 && b == wpos1) {
-      /* wvalue1 is odd and < 2^window1 */
-      if (!BN_mod_mul_montgomery(r, r, val1[wvalue1 >> 1], mont, ctx)) {
-        goto err;
-      }
-      wvalue1 = 0;
-      r_is_one = 0;
-    }
-
-    if (wvalue2 && b == wpos2) {
-      /* wvalue2 is odd and < 2^window2 */
-      if (!BN_mod_mul_montgomery(r, r, val2[wvalue2 >> 1], mont, ctx)) {
-        goto err;
-      }
-      wvalue2 = 0;
-      r_is_one = 0;
-    }
-  }
-
-  if (!BN_from_montgomery(rr, r, mont, ctx)) {
-    goto err;
-  }
   ret = 1;
 
 err:
   BN_MONT_CTX_free(new_mont);
-  BN_CTX_end(ctx);
+  BN_free(&tmp);
+
   return ret;
 }