grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/jacobi.cc.inc

@@ -19,10 +19,12 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 // least significant word
-#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0])
+#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG)0 : (n)->d[0])
 
-int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
+int bssl::bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
   // In 'tab', only odd-indexed entries are relevant:
   // For any odd BIGNUM n,
   //     tab[BN_lsw(n) & 7]
@@ -42,32 +44,29 @@ int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
     return -2;
   }
 
-  int ret = -2;
-  BN_CTX_start(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *A = BN_CTX_get(ctx);
   BIGNUM *B = BN_CTX_get(ctx);
-  if (B == NULL) {
-    goto end;
+  if (B == nullptr) {
+    return -2;
   }
 
   if (!BN_copy(A, a) ||
       !BN_copy(B, b)) {
-    goto end;
+    return -2;
   }
 
   // Adapted from logic to compute the Kronecker symbol, originally implemented
   // according to Henri Cohen, "A Course in Computational Algebraic Number
   // Theory" (algorithm 1.4.10).
 
-  ret = 1;
-
+  int ret = 1;
   while (1) {
     // Cohen's step 3:
 
     // B is positive and odd
     if (BN_is_zero(A)) {
-      ret = BN_is_one(B) ? ret : 0;
-      goto end;
+      return BN_is_one(B) ? ret : 0;
     }
 
     // now A is non-zero
@@ -76,8 +75,7 @@ int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
       i++;
     }
     if (!BN_rshift(A, A, i)) {
-      ret = -2;
-      goto end;
+      return -2;
     }
     if (i & 1) {
       // i is odd
@@ -93,16 +91,11 @@ int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
 
     // (A, B) := (B mod |A|, |A|)
     if (!BN_nnmod(B, B, A, ctx)) {
-      ret = -2;
-      goto end;
+      return -2;
     }
     BIGNUM *tmp = A;
     A = B;
     B = tmp;
     tmp->neg = 0;
   }
-
-end:
-  BN_CTX_end(ctx);
-  return ret;
 }

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/montgomery.cc.inc

@@ -21,28 +21,29 @@
 
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/thread.h>
 
 #include "../../internal.h"
+#include "../../mem_internal.h"
 #include "internal.h"
 
 
-void bn_mont_ctx_init(BN_MONT_CTX *mont) {
+using namespace bssl;
+
+void bssl::bn_mont_ctx_init(BN_MONT_CTX *mont) {
   OPENSSL_memset(mont, 0, sizeof(BN_MONT_CTX));
   BN_init(&mont->RR);
   BN_init(&mont->N);
 }
 
-void bn_mont_ctx_cleanup(BN_MONT_CTX *mont) {
+void bssl::bn_mont_ctx_cleanup(BN_MONT_CTX *mont) {
   BN_free(&mont->RR);
   BN_free(&mont->N);
 }
 
-BN_MONT_CTX *BN_MONT_CTX_new(void) {
-  BN_MONT_CTX *ret =
-      reinterpret_cast<BN_MONT_CTX *>(OPENSSL_malloc(sizeof(BN_MONT_CTX)));
-  if (ret == NULL) {
-    return NULL;
+BN_MONT_CTX *BN_MONT_CTX_new() {
+  BN_MONT_CTX *ret = New<BN_MONT_CTX>();
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   bn_mont_ctx_init(ret);
@@ -54,7 +55,7 @@ void BN_MONT_CTX_free(BN_MONT_CTX *mont) {
     return;
   }
   bn_mont_ctx_cleanup(mont);
-  OPENSSL_free(mont);
+  Delete(mont);
 }
 
 BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, const BN_MONT_CTX *from) {
@@ -63,10 +64,11 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, const BN_MONT_CTX *from) {
   }
 
   if (!BN_copy(&to->RR, &from->RR) || !BN_copy(&to->N, &from->N)) {
-    return NULL;
+    return nullptr;
+  }
+  for (size_t i = 0; i < BN_MONT_CTX_N0_LIMBS; i++) {
+    to->n0[i] = from->n0[i];
   }
-  to->n0[0] = from->n0[0];
-  to->n0[1] = from->n0[1];
   return to;
 }
 
@@ -93,7 +95,7 @@ static int bn_mont_ctx_set_N_and_n0(BN_MONT_CTX *mont, const BIGNUM *mod) {
     OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR);
     return 0;
   }
-  // |mont->N| is always stored minimally. Computing RR efficiently leaks the
+  // `mont->N` is always stored minimally. Computing RR efficiently leaks the
   // size of the modulus. While the modulus may be private in RSA (one of the
   // primes), their sizes are public, so this is fine.
   bn_set_minimal_width(&mont->N);
@@ -101,8 +103,8 @@ static int bn_mont_ctx_set_N_and_n0(BN_MONT_CTX *mont, const BIGNUM *mod) {
   // Find n0 such that n0 * N == -1 (mod r).
   //
   // Only certain BN_BITS2<=32 platforms actually make use of n0[1]. For the
-  // others, we could use a shorter R value and use faster |BN_ULONG|-based
-  // math instead of |uint64_t|-based math, which would be double-precision.
+  // others, we could use a shorter R value and use faster `BN_ULONG`-based
+  // math instead of `uint64_t`-based math, which would be double-precision.
   // However, currently only the assembler files know which is which.
   static_assert(BN_MONT_CTX_N0_LIMBS == 1 || BN_MONT_CTX_N0_LIMBS == 2,
                 "BN_MONT_CTX_N0_LIMBS value is invalid");
@@ -112,8 +114,6 @@ static int bn_mont_ctx_set_N_and_n0(BN_MONT_CTX *mont, const BIGNUM *mod) {
   mont->n0[0] = (BN_ULONG)n0;
 #if BN_MONT_CTX_N0_LIMBS == 2
   mont->n0[1] = (BN_ULONG)(n0 >> BN_BITS2);
-#else
-  mont->n0[1] = 0;
 #endif
   return 1;
 }
@@ -123,10 +123,10 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) {
     return 0;
   }
 
-  BN_CTX *new_ctx = NULL;
-  if (ctx == NULL) {
+  BN_CTX *new_ctx = nullptr;
+  if (ctx == nullptr) {
     new_ctx = BN_CTX_new();
-    if (new_ctx == NULL) {
+    if (new_ctx == nullptr) {
       return 0;
     }
     ctx = new_ctx;
@@ -134,9 +134,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) {
 
   // Save RR = R**2 (mod N). R is the smallest power of 2**BN_BITS2 such that R
   // > mod. Even though the assembly on some 32-bit platforms works with 64-bit
-  // values, using |BN_BITS2| here, rather than |BN_MONT_CTX_N0_LIMBS *
-  // BN_BITS2|, is correct because R**2 will still be a multiple of the latter
-  // as |BN_MONT_CTX_N0_LIMBS| is either one or two.
+  // values, using `BN_BITS2` here, rather than
+  // `BN_MONT_CTX_N0_LIMBS * BN_BITS2`, is correct because R**2 will still be a
+  // multiple of the latter as `BN_MONT_CTX_N0_LIMBS` is either one or two.
   unsigned lgBigR = mont->N.width * BN_BITS2;
   BN_zero(&mont->RR);
   int ok = BN_set_bit(&mont->RR, lgBigR * 2) &&
@@ -148,40 +148,38 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) {
 
 BN_MONT_CTX *BN_MONT_CTX_new_for_modulus(const BIGNUM *mod, BN_CTX *ctx) {
   BN_MONT_CTX *mont = BN_MONT_CTX_new();
-  if (mont == NULL || !BN_MONT_CTX_set(mont, mod, ctx)) {
+  if (mont == nullptr || !BN_MONT_CTX_set(mont, mod, ctx)) {
     BN_MONT_CTX_free(mont);
-    return NULL;
+    return nullptr;
   }
   return mont;
 }
 
 BN_MONT_CTX *BN_MONT_CTX_new_consttime(const BIGNUM *mod, BN_CTX *ctx) {
   BN_MONT_CTX *mont = BN_MONT_CTX_new();
-  if (mont == NULL || !bn_mont_ctx_set_N_and_n0(mont, mod) ||
+  if (mont == nullptr || !bn_mont_ctx_set_N_and_n0(mont, mod) ||
       !bn_mont_ctx_set_RR_consttime(mont, ctx)) {
     BN_MONT_CTX_free(mont);
-    return NULL;
+    return nullptr;
   }
   return mont;
 }
 
-int BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_MUTEX *lock,
-                           const BIGNUM *mod, BN_CTX *bn_ctx) {
-  CRYPTO_MUTEX_lock_read(lock);
-  BN_MONT_CTX *ctx = *pmont;
-  CRYPTO_MUTEX_unlock_read(lock);
+int bssl::BN_MONT_CTX_set_locked(UniquePtr<BN_MONT_CTX> *pmont, Mutex *lock,
+                                 const BIGNUM *mod, BN_CTX *bn_ctx) {
+  lock->LockRead();
+  BN_MONT_CTX *ctx = pmont->get();
+  lock->UnlockRead();
 
   if (ctx) {
     return 1;
   }
 
-  CRYPTO_MUTEX_lock_write(lock);
-  if (*pmont == NULL) {
-    *pmont = BN_MONT_CTX_new_for_modulus(mod, bn_ctx);
+  MutexWriteLock write_lock(lock);
+  if (*pmont == nullptr) {
+    pmont->reset(BN_MONT_CTX_new_for_modulus(mod, bn_ctx));
   }
-  const int ok = *pmont != NULL;
-  CRYPTO_MUTEX_unlock_write(lock);
-  return ok;
+  return *pmont != nullptr;
 }
 
 int BN_to_montgomery(BIGNUM *ret, const BIGNUM *a, const BN_MONT_CTX *mont,
@@ -198,24 +196,21 @@ static int bn_from_montgomery_in_place(BN_ULONG *r, size_t num_r, BN_ULONG *a,
     return 0;
   }
 
-  // Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On
-  // input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r|
-  // includes |carry| which is stored separately.
+  // Add multiples of `n` to `r` until R = 2^(nl * BN_BITS2) divides it. On
+  // input, we had `r` < `n` * R, so now `r` < 2 * `n` * R. Note that `r`
+  // includes `carry` which is stored separately.
   BN_ULONG n0 = mont->n0[0];
   BN_ULONG carry = 0;
   for (size_t i = 0; i < num_n; i++) {
     BN_ULONG v = bn_mul_add_words(a + i, n, num_n, a[i] * n0);
-    v += carry + a[i + num_n];
-    carry |= (v != a[i + num_n]);
-    carry &= (v <= a[i + num_n]);
-    a[i + num_n] = v;
+    a[i + num_n] = CRYPTO_addc_w(a[i + num_n], v, carry, &carry);
   }
 
-  // Shift |num_n| words to divide by R. We have |a| < 2 * |n|. Note that |a|
-  // includes |carry| which is stored separately.
+  // Shift `num_n` words to divide by R. We have `a` < 2 * `n`. Note that `a`
+  // includes `carry` which is stored separately.
   a += num_n;
 
-  // |a| thus requires at most one additional subtraction |n| to be reduced.
+  // `a` thus requires at most one additional subtraction `n` to be reduced.
   bn_reduce_once(r, a, carry, n, num_n);
   return 1;
 }
@@ -245,26 +240,19 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r,
 
 int BN_from_montgomery(BIGNUM *r, const BIGNUM *a, const BN_MONT_CTX *mont,
                        BN_CTX *ctx) {
-  int ret = 0;
-  BIGNUM *t;
-
-  BN_CTX_start(ctx);
-  t = BN_CTX_get(ctx);
-  if (t == NULL || !BN_copy(t, a)) {
-    goto err;
+  BN_CTXScope scope(ctx);
+  BIGNUM *t = BN_CTX_get(ctx);
+  if (t == nullptr || !BN_copy(t, a)) {
+    return 0;
   }
 
-  ret = BN_from_montgomery_word(r, t, mont);
-
-err:
-  BN_CTX_end(ctx);
-
-  return ret;
+  return BN_from_montgomery_word(r, t, mont);
 }
 
-int bn_one_to_montgomery(BIGNUM *r, const BN_MONT_CTX *mont, BN_CTX *ctx) {
-  // If the high bit of |n| is set, R = 2^(width*BN_BITS2) < 2 * |n|, so we
-  // compute R - |n| rather than perform Montgomery reduction.
+int bssl::bn_one_to_montgomery(BIGNUM *r, const BN_MONT_CTX *mont,
+                               BN_CTX *ctx) {
+  // If the high bit of `n` is set, R = 2^(width*BN_BITS2) < 2 * `n`, so we
+  // compute R - `n` rather than perform Montgomery reduction.
   const BIGNUM *n = &mont->N;
   if (n->width > 0 && (n->d[n->width - 1] >> (BN_BITS2 - 1)) != 0) {
     if (!bn_wexpand(r, n->width)) {
@@ -286,34 +274,28 @@ static int bn_mod_mul_montgomery_fallback(BIGNUM *r, const BIGNUM *a,
                                           const BIGNUM *b,
                                           const BN_MONT_CTX *mont,
                                           BN_CTX *ctx) {
-  int ret = 0;
-
-  BN_CTX_start(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  if (tmp == NULL) {
-    goto err;
+  if (tmp == nullptr) {
+    return 0;
   }
 
   if (a == b) {
     if (!bn_sqr_consttime(tmp, a, ctx)) {
-      goto err;
+      return 0;
     }
   } else {
     if (!bn_mul_consttime(tmp, a, b, ctx)) {
-      goto err;
+      return 0;
     }
   }
 
   // reduce from aRR to aR
   if (!BN_from_montgomery_word(r, tmp, mont)) {
-    goto err;
+    return 0;
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
@@ -324,16 +306,16 @@ int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
   }
 
 #if defined(OPENSSL_BN_ASM_MONT)
-  // |bn_mul_mont| requires at least 128 bits of limbs.
+  // `bn_mul_mont_words` requires at least 128 bits of limbs.
   int num = mont->N.width;
   if (num >= (128 / BN_BITS2) && a->width == num && b->width == num) {
     if (!bn_wexpand(r, num)) {
       return 0;
     }
-    // This bound is implied by |bn_mont_ctx_set_N_and_n0|. |bn_mul_mont|
-    // allocates |num| words on the stack, so |num| cannot be too large.
+    // This bound is implied by `bn_mont_ctx_set_N_and_n0`. `bn_mul_mont_words`
+    // allocates `num` words on the stack, so `num` cannot be too large.
     assert((size_t)num <= BN_MONTGOMERY_MAX_WORDS);
-    bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num);
+    bn_mul_mont_words(r->d, a->d, b->d, mont->N.d, mont->n0, num);
     r->neg = 0;
     r->width = num;
     return 1;
@@ -343,17 +325,18 @@ int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
   return bn_mod_mul_montgomery_fallback(r, a, b, mont, ctx);
 }
 
-int bn_less_than_montgomery_R(const BIGNUM *bn, const BN_MONT_CTX *mont) {
+int bssl::bn_less_than_montgomery_R(const BIGNUM *bn, const BN_MONT_CTX *mont) {
   return !BN_is_negative(bn) && bn_fits_in_words(bn, mont->N.width);
 }
 
-void bn_to_montgomery_small(BN_ULONG *r, const BN_ULONG *a, size_t num,
-                            const BN_MONT_CTX *mont) {
+void bssl::bn_to_montgomery_small(BN_ULONG *r, const BN_ULONG *a, size_t num,
+                                  const BN_MONT_CTX *mont) {
   bn_mod_mul_montgomery_small(r, a, mont->RR.d, num, mont);
 }
 
-void bn_from_montgomery_small(BN_ULONG *r, size_t num_r, const BN_ULONG *a,
-                              size_t num_a, const BN_MONT_CTX *mont) {
+void bssl::bn_from_montgomery_small(BN_ULONG *r, size_t num_r,
+                                    const BN_ULONG *a, size_t num_a,
+                                    const BN_MONT_CTX *mont) {
   if (num_r != (size_t)mont->N.width || num_r > BN_SMALL_MAX_WORDS ||
       num_a > 2 * num_r) {
     abort();
@@ -366,17 +349,17 @@ void bn_from_montgomery_small(BN_ULONG *r, size_t num_r, const BN_ULONG *a,
   OPENSSL_cleanse(tmp, 2 * num_r * sizeof(BN_ULONG));
 }
 
-void bn_mod_mul_montgomery_small(BN_ULONG *r, const BN_ULONG *a,
-                                 const BN_ULONG *b, size_t num,
-                                 const BN_MONT_CTX *mont) {
+void bssl::bn_mod_mul_montgomery_small(BN_ULONG *r, const BN_ULONG *a,
+                                       const BN_ULONG *b, size_t num,
+                                       const BN_MONT_CTX *mont) {
   if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) {
     abort();
   }
 
 #if defined(OPENSSL_BN_ASM_MONT)
-  // |bn_mul_mont| requires at least 128 bits of limbs.
+  // `bn_mul_mont_words` requires at least 128 bits of limbs.
   if (num >= (128 / BN_BITS2)) {
-    bn_mul_mont(r, a, b, mont->N.d, mont->n0, num);
+    bn_mul_mont_words(r, a, b, mont->N.d, mont->n0, num);
     return;
   }
 #endif
@@ -397,8 +380,9 @@ void bn_mod_mul_montgomery_small(BN_ULONG *r, const BN_ULONG *a,
 }
 
 #if defined(OPENSSL_BN_ASM_MONT) && defined(OPENSSL_X86_64)
-void bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                const BN_ULONG *np, const BN_ULONG *n0, size_t num) {
+void bssl::bn_mul_mont_words(BN_ULONG *rp, const BN_ULONG *ap,
+                             const BN_ULONG *bp, const BN_ULONG *np,
+                             const BN_ULONG *n0, size_t num) {
   if (ap == bp && bn_sqr8x_mont_capable(num)) {
     bn_sqr8x_mont(rp, ap, bn_mulx_adx_capable(), np, n0, num);
   } else if (bn_mulx4x_mont_capable(num)) {
@@ -412,8 +396,9 @@ void bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
 #endif
 
 #if defined(OPENSSL_BN_ASM_MONT) && defined(OPENSSL_ARM)
-void bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                 const BN_ULONG *np, const BN_ULONG *n0, size_t num) {
+void bssl::bn_mul_mont_words(BN_ULONG *rp, const BN_ULONG *ap,
+                             const BN_ULONG *bp, const BN_ULONG *np,
+                             const BN_ULONG *n0, size_t num) {
   if (bn_mul8x_mont_neon_capable(num)) {
     bn_mul8x_mont_neon(rp, ap, bp, np, n0, num);
   } else {

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/montgomery_inv.cc.inc

@@ -20,41 +20,40 @@
 #include "../../internal.h"
 
 
-static uint64_t bn_neg_inv_mod_r_u64(uint64_t n);
+using namespace bssl;
+
+static uint64_t bn_neg_inv_mod_u64(uint64_t n);
 
 static_assert(BN_MONT_CTX_N0_LIMBS == 1 || BN_MONT_CTX_N0_LIMBS == 2,
               "BN_MONT_CTX_N0_LIMBS value is invalid");
 static_assert(sizeof(BN_ULONG) * BN_MONT_CTX_N0_LIMBS == sizeof(uint64_t),
               "uint64_t is insufficient precision for n0");
 
-// LG_LITTLE_R is log_2(r).
-#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2)
-
-uint64_t bn_mont_n0(const BIGNUM *n) {
-  // These conditions are checked by the caller, |BN_MONT_CTX_set| or
-  // |BN_MONT_CTX_new_consttime|.
+uint64_t bssl::bn_mont_n0(const BIGNUM *n) {
+  // These conditions are checked by the caller, `BN_MONT_CTX_set` or
+  // `BN_MONT_CTX_new_consttime`.
   assert(!BN_is_zero(n));
   assert(!BN_is_negative(n));
   assert(BN_is_odd(n));
 
-  // r == 2**(BN_MONT_CTX_N0_LIMBS * BN_BITS2) and LG_LITTLE_R == lg(r). This
-  // ensures that we can do integer division by |r| by simply ignoring
-  // |BN_MONT_CTX_N0_LIMBS| limbs. Similarly, we can calculate values modulo
-  // |r| by just looking at the lowest |BN_MONT_CTX_N0_LIMBS| limbs. This is
-  // what makes Montgomery multiplication efficient.
+  // r == 2**(BN_MONT_CTX_N0_LIMBS * BN_BITS2) ensures that we can do integer
+  // division by `r` by simply ignoring `BN_MONT_CTX_N0_LIMBS` limbs. Similarly,
+  // we can calculate values modulo `r` by just looking at the lowest
+  // `BN_MONT_CTX_N0_LIMBS` limbs. This is what makes Montgomery multiplication
+  // efficient.
   //
   // As shown in Algorithm 1 of "Fast Prime Field Elliptic Curve Cryptography
   // with 256 Bit Primes" by Shay Gueron and Vlad Krasnov, in the loop of a
-  // multi-limb Montgomery multiplication of |a * b (mod n)|, given the
-  // unreduced product |t == a * b|, we repeatedly calculate:
+  // multi-limb Montgomery multiplication of `a * b (mod n)`, given the
+  // unreduced product `t == a * b`, we repeatedly calculate:
   //
-  //    t1 := t % r         |t1| is |t|'s lowest limb (see previous paragraph).
+  //    t1 := t % r         `t1` is `t`'s lowest limb (see previous paragraph).
   //    t2 := t1*n0*n
   //    t3 := t + t2
-  //    t := t3 / r         copy all limbs of |t3| except the lowest to |t|.
+  //    t := t3 / r         copy all limbs of `t3` except the lowest to `t`.
   //
   // In the last step, it would only make sense to ignore the lowest limb of
-  // |t3| if it were zero. The middle steps ensure that this is the case:
+  // `t3` if it were zero. The middle steps ensure that this is the case:
   //
   //                            t3 ==  0 (mod r)
   //                        t + t2 ==  0 (mod r)
@@ -65,10 +64,10 @@ uint64_t bn_mont_n0(const BIGNUM *n) {
   //                            n0 == -1/n (mod r)
   //
   // Thus, in each iteration of the loop, we multiply by the constant factor
-  // |n0|, the negative inverse of n (mod r).
+  // `n0`, the negative inverse of n (mod r).
 
   // n_mod_r = n % r. As explained above, this is done by taking the lowest
-  // |BN_MONT_CTX_N0_LIMBS| limbs of |n|.
+  // `BN_MONT_CTX_N0_LIMBS` limbs of `n`.
   uint64_t n_mod_r = n->d[0];
 #if BN_MONT_CTX_N0_LIMBS == 2
   if (n->width > 1) {
@@ -76,90 +75,48 @@ uint64_t bn_mont_n0(const BIGNUM *n) {
   }
 #endif
 
-  return bn_neg_inv_mod_r_u64(n_mod_r);
+  // A 64-bit inverse is enough precision to invert by r. (r is also currently
+  // always 2^64.)
+  return bn_neg_inv_mod_u64(n_mod_r);
 }
 
-// bn_neg_inv_r_mod_n_u64 calculates the -1/n mod r; i.e. it calculates |v|
-// such that u*r - v*n == 1. |r| is the constant defined in |bn_mont_n0|. |n|
-// must be odd.
-//
-// This is derived from |xbinGCD| in Henry S. Warren, Jr.'s "Montgomery
-// Multiplication" (http://www.hackersdelight.org/MontgomeryMultiplication.pdf).
-// It is very similar to the MODULAR-INVERSE function in Stephen R. Dussé's and
-// Burton S. Kaliski Jr.'s "A Cryptographic Library for the Motorola DSP56000"
-// (http://link.springer.com/chapter/10.1007%2F3-540-46877-3_21).
-//
-// This is inspired by Joppe W. Bos's "Constant Time Modular Inversion"
-// (http://www.joppebos.com/files/CTInversion.pdf) so that the inversion is
-// constant-time with respect to |n|. We assume uint64_t additions,
-// subtractions, shifts, and bitwise operations are all constant time, which
-// may be a large leap of faith on 32-bit targets. We avoid division and
-// multiplication, which tend to be the most problematic in terms of timing
-// leaks.
-//
-// Most GCD implementations return values such that |u*r + v*n == 1|, so the
-// caller would have to negate the resultant |v| for the purpose of Montgomery
-// multiplication. This implementation does the negation implicitly by doing
-// the computations as a difference instead of a sum.
-static uint64_t bn_neg_inv_mod_r_u64(uint64_t n) {
+// bn_neg_inv_mod_u64 calculates -1/n mod 2^64. `n` must be odd.
+static uint64_t bn_neg_inv_mod_u64(uint64_t n) {
+  // This is a modified version of the technique described in
+  // https://crypto.stackexchange.com/a/47496 and
+  // https://bearssl.org/bigint.html#montgomery-reduction-and-multiplication. We
+  // modify it to compute the negative inverse directly so that, on 32-bit,
+  // negation happens before we go to double-word precision, instead of at the
+  // end.
+  //
+  // If r = -n^-1 (mod m), then r * (r*n + 2) is -n^(-1) (mod m^2). This is
+  // because, for some k, r*n = k*m - 1. Then:
+  //
+  //     r*n * (r*n + 2) = (k*m - 1) * (k*m + 1) = k^2*m^2 - 1 = -1 (mod m^2)
+  //
+  // We start with the negative inverse mod some small power of 2 and square the
+  // modulus up to 2^64. n = n^-1 (mod 8) for all odd n, so r = -n (mod 8). From
+  // there, four iterations are enough for 2^32 and five for 2^64.
   assert(n % 2 == 1);
-
-  // alpha == 2**(lg r - 1) == r / 2.
-  static const uint64_t alpha = UINT64_C(1) << (LG_LITTLE_R - 1);
-
-  const uint64_t beta = n;
-
-  uint64_t u = 1;
-  uint64_t v = 0;
-
-  // The invariant maintained from here on is:
-  // 2**(lg r - i) == u*2*alpha - v*beta.
-  for (size_t i = 0; i < LG_LITTLE_R; ++i) {
-#if BN_BITS2 == 64 && defined(BN_ULLONG)
-    assert((BN_ULLONG)(1) << (LG_LITTLE_R - i) ==
-           ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta));
-#endif
-
-    // Delete a common factor of 2 in u and v if |u| is even. Otherwise, set
-    // |u = (u + beta) / 2| and |v = (v / 2) + alpha|.
-
-    uint64_t u_is_odd = UINT64_C(0) - (u & 1);  // Either 0xff..ff or 0.
-
-    // The addition can overflow, so use Dietz's method for it.
-    //
-    // Dietz calculates (x+y)/2 by (x⊕y)>>1 + x&y. This is valid for all
-    // (unsigned) x and y, even when x+y overflows. Evidence for 32-bit values
-    // (embedded in 64 bits to so that overflow can be ignored):
-    //
-    // (declare-fun x () (_ BitVec 64))
-    // (declare-fun y () (_ BitVec 64))
-    // (assert (let (
-    //    (one (_ bv1 64))
-    //    (thirtyTwo (_ bv32 64)))
-    //    (and
-    //      (bvult x (bvshl one thirtyTwo))
-    //      (bvult y (bvshl one thirtyTwo))
-    //      (not (=
-    //        (bvadd (bvlshr (bvxor x y) one) (bvand x y))
-    //        (bvlshr (bvadd x y) one)))
-    // )))
-    // (check-sat)
-    uint64_t beta_if_u_is_odd = beta & u_is_odd;  // Either |beta| or 0.
-    u = ((u ^ beta_if_u_is_odd) >> 1) + (u & beta_if_u_is_odd);
-
-    uint64_t alpha_if_u_is_odd = alpha & u_is_odd;  // Either |alpha| or 0.
-    v = (v >> 1) + alpha_if_u_is_odd;
+#if defined(OPENSSL_32_BIT)
+  // Compute the result mod 2^32 first.
+  uint32_t n32 = static_cast<uint32_t>(n);
+  uint32_t r = 0u - n32;
+  for (int i = 0; i < 4; i++) {
+    r *= r * n32 + 2;
   }
-
-  // The invariant now shows that u*r - v*n == 1 since r == 2 * alpha.
-#if BN_BITS2 == 64 && defined(BN_ULLONG)
-  declassify_assert(1 == ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta));
+  // Run one more double-word iteration to get the result mod 2^64.
+  return r * (r * n + 2);
+#else
+  uint64_t r = 0u - n;
+  for (int i = 0; i < 5; i++) {
+    r *= r * n + 2;
+  }
+  return r;
 #endif
-
-  return v;
 }
 
-int bn_mont_ctx_set_RR_consttime(BN_MONT_CTX *mont, BN_CTX *ctx) {
+int bssl::bn_mont_ctx_set_RR_consttime(BN_MONT_CTX *mont, BN_CTX *ctx) {
   assert(!BN_is_zero(&mont->N));
   assert(!BN_is_negative(&mont->N));
   assert(BN_is_odd(&mont->N));