grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/random.cc.inc

@@ -26,8 +26,10 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 int BN_rand(BIGNUM *rnd, int bits, int top, int bottom) {
-  if (rnd == NULL) {
+  if (rnd == nullptr) {
     return 0;
   }
 
@@ -92,7 +94,7 @@ int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom) {
 }
 
 // bn_less_than_word_mask returns a mask of all ones if the number represented
-// by |len| words at |a| is less than |b| and zero otherwise. It performs this
+// by `len` words at |a| is less than |b| and zero otherwise. It performs this
 // computation in time independent of the value of |a|. |b| is assumed public.
 static crypto_word_t bn_less_than_word_mask(const BN_ULONG *a, size_t len,
                                             BN_ULONG b) {
@@ -110,14 +112,14 @@ static crypto_word_t bn_less_than_word_mask(const BN_ULONG *a, size_t len,
   for (size_t i = 1; i < len; i++) {
     mask |= a[i];
   }
-  // |mask| is now zero iff a[1..len-1] are all zero.
+  // `mask` is now zero iff a[1..len-1] are all zero.
   mask = constant_time_is_zero_w(mask);
   mask &= constant_time_lt_w(a[0], b);
   return mask;
 }
 
-int bn_in_range_words(const BN_ULONG *a, BN_ULONG min_inclusive,
-                      const BN_ULONG *max_exclusive, size_t len) {
+int bssl::bn_in_range_words(const BN_ULONG *a, BN_ULONG min_inclusive,
+                            const BN_ULONG *max_exclusive, size_t len) {
   crypto_word_t mask = ~bn_less_than_word_mask(a, len, min_inclusive);
   return mask & bn_less_than_words(a, max_exclusive, len);
 }
@@ -125,7 +127,7 @@ int bn_in_range_words(const BN_ULONG *a, BN_ULONG min_inclusive,
 static int bn_range_to_mask(size_t *out_words, BN_ULONG *out_mask,
                             size_t min_inclusive, const BN_ULONG *max_exclusive,
                             size_t len) {
-  // The magnitude of |max_exclusive| is assumed public.
+  // The magnitude of `max_exclusive` is assumed public.
   size_t words = len;
   while (words > 0 && max_exclusive[words - 1] == 0) {
     words--;
@@ -135,7 +137,7 @@ static int bn_range_to_mask(size_t *out_words, BN_ULONG *out_mask,
     return 0;
   }
   BN_ULONG mask = max_exclusive[words - 1];
-  // This sets all bits in |mask| below the most significant bit.
+  // This sets all bits in `mask` below the most significant bit.
   mask |= mask >> 1;
   mask |= mask >> 2;
   mask |= mask >> 4;
@@ -150,15 +152,15 @@ static int bn_range_to_mask(size_t *out_words, BN_ULONG *out_mask,
   return 1;
 }
 
-int bn_rand_range_words(BN_ULONG *out, BN_ULONG min_inclusive,
-                        const BN_ULONG *max_exclusive, size_t len,
-                        const uint8_t additional_data[32]) {
-  // This function implements the equivalent of steps 4 through 7 of FIPS 186-4
-  // appendices B.4.2 and B.5.2. When called in those contexts, |max_exclusive|
-  // is n and |min_inclusive| is one.
+int bssl::bn_rand_range_words(BN_ULONG *out, BN_ULONG min_inclusive,
+                              const BN_ULONG *max_exclusive, size_t len,
+                              const uint8_t additional_data[32]) {
+  // This function implements the equivalent of steps 1 through 4 of FIPS 186-5
+  // appendices A.2.2 and A.3.2, repeating the process on failure. When called
+  // in those contexts, `max_exclusive` is n and `min_inclusive` is one.
 
-  // Compute the bit length of |max_exclusive| (step 1), in terms of a number of
-  // |words| worth of entropy to fill and a mask of bits to clear in the top
+  // Compute the bit length of `max_exclusive` (step 1), in terms of a number of
+  // `words` worth of entropy to fill and a mask of bits to clear in the top
   // word.
   size_t words;
   BN_ULONG mask;
@@ -176,21 +178,19 @@ int bn_rand_range_words(BN_ULONG *out, BN_ULONG min_inclusive,
       return 0;
     }
 
-    // Steps 4 and 5. Use |words| and |mask| together to obtain a string of N
-    // bits, where N is the bit length of |max_exclusive|.
+    // Use `words` and `mask` together to obtain a string of N bits, where N is
+    // the bit length of `max_exclusive`.
     FIPS_service_indicator_lock_state();
     BCM_rand_bytes_with_additional_data(
         (uint8_t *)out, words * sizeof(BN_ULONG), additional_data);
     FIPS_service_indicator_unlock_state();
     out[words - 1] &= mask;
 
-    // If out >= max_exclusive or out < min_inclusive, retry. This implements
-    // the equivalent of steps 6 and 7 without leaking the value of |out|. The
-    // result of this comparison may be treated as public. It only reveals how
-    // many attempts were needed before we found a value in range. This is
-    // independent of the final secret output, and has a distribution that
-    // depends only on |min_inclusive| and |max_exclusive|, both of which are
-    // public.
+    // If out >= max_exclusive or out < min_inclusive, retry. The result of this
+    // comparison may be treated as public. It only reveals how many attempts
+    // were needed before we found a value in range. This is independent of the
+    // final secret output, and has a distribution that depends only on
+    // `min_inclusive` and `max_exclusive`, both of which are public.
   } while (!constant_time_declassify_int(
       bn_in_range_words(out, min_inclusive, max_exclusive, words)));
   return 1;
@@ -210,8 +210,9 @@ int BN_rand_range_ex(BIGNUM *r, BN_ULONG min_inclusive,
   return 1;
 }
 
-int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
-                         const BIGNUM *max_exclusive) {
+int bssl::bn_rand_secret_range(BIGNUM *r, int *out_is_uniform,
+                               BN_ULONG min_inclusive,
+                               const BIGNUM *max_exclusive) {
   size_t words;
   BN_ULONG mask;
   if (!bn_range_to_mask(&words, &mask, min_inclusive, max_exclusive->d,

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/rsaz_exp.cc.inc

@@ -29,6 +29,8 @@
 #include "../../internal.h"
 
 
+using namespace bssl;
+
 // rsaz_one is 1 in RSAZ's representation.
 alignas(64) static const BN_ULONG rsaz_one[40] = {
     1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
@@ -39,18 +41,18 @@ alignas(64) static const BN_ULONG rsaz_two80[40] = {
     0, 0, 1 << 22, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0,       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 
-void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
-                            const BN_ULONG base_norm[16],
-                            const BN_ULONG exponent[16],
-                            const BN_ULONG m_norm[16], const BN_ULONG RR[16],
-                            BN_ULONG k0,
-                            BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN]) {
+void bssl::RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
+                                  const BN_ULONG base_norm[16],
+                                  const BN_ULONG exponent[16],
+                                  const BN_ULONG m_norm[16],
+                                  const BN_ULONG RR[16], BN_ULONG k0,
+                                  BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN]) {
   static_assert(MOD_EXP_CTIME_ALIGN % 64 == 0,
                 "MOD_EXP_CTIME_ALIGN is too small");
   assert((uintptr_t)storage % 64 == 0);
 
   BN_ULONG *a_inv, *m, *result, *table_s = storage + 40 * 3, *R2 = table_s;
-  // Note |R2| aliases |table_s|.
+  // Note `R2` aliases `table_s`.
   if (((((uintptr_t)storage & 4095) + 320) >> 12) != 0) {
     result = storage;
     a_inv = storage + 40;
@@ -65,7 +67,7 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   rsaz_1024_norm2red_avx2(a_inv, base_norm);
   rsaz_1024_norm2red_avx2(R2, RR);
 
-  // Convert |R2| from the usual radix, giving R = 2^1024, to RSAZ's radix,
+  // Convert `R2` from the usual radix, giving R = 2^1024, to RSAZ's radix,
   // giving R = 2^(36*29) = 2^1044.
   rsaz_1024_mul_avx2(R2, R2, R2, m, k0);
   // R2 = 2^2048 * 2^2048 / 2^1044 = 2^3052
@@ -117,7 +119,7 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
     wvalue = (wvalue >> (index % 8)) & 31;
     index -= 5;
 
-    rsaz_1024_gather5_avx2(a_inv, table_s, wvalue);  // Borrow |a_inv|.
+    rsaz_1024_gather5_avx2(a_inv, table_s, wvalue);  // Borrow `a_inv`.
     rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
   }
 
@@ -126,7 +128,7 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
 
   wvalue = p_str[0] & 15;
 
-  rsaz_1024_gather5_avx2(a_inv, table_s, wvalue);  // Borrow |a_inv|.
+  rsaz_1024_gather5_avx2(a_inv, table_s, wvalue);  // Borrow `a_inv`.
   rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
 
   // Convert from Montgomery.

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/rsaz_exp.h

@@ -22,38 +22,36 @@
 
 #include <openssl/bn.h>
 
-#include "internal.h"
 #include "../../internal.h"
+#include "internal.h"
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
+
+BSSL_NAMESPACE_BEGIN
 
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
 #define RSAZ_ENABLED
 
-
-// RSAZ_1024_mod_exp_avx2 sets |result| to |base_norm| raised to |exponent|
-// modulo |m_norm|. |base_norm| must be fully-reduced and |exponent| must have
-// the high bit set (it is 1024 bits wide). |RR| and |k0| must be |RR| and |n0|,
-// respectively, extracted from |m_norm|'s |BN_MONT_CTX|. |storage_words| is a
-// temporary buffer that must be aligned to |MOD_EXP_CTIME_ALIGN| bytes.
+// RSAZ_1024_mod_exp_avx2 sets `result` to `base_norm` raised to `exponent`
+// modulo `m_norm`. `base_norm` must be fully-reduced and `exponent` must have
+// the high bit set (it is 1024 bits wide). `RR` and `k0` must be `RR` and `n0`,
+// respectively, extracted from `m_norm`'s `BN_MONT_CTX`. `storage_words` is a
+// temporary buffer that must be aligned to `MOD_EXP_CTIME_ALIGN` bytes.
 void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16], const BN_ULONG base_norm[16],
                             const BN_ULONG exponent[16],
                             const BN_ULONG m_norm[16], const BN_ULONG RR[16],
                             BN_ULONG k0,
                             BN_ULONG storage_words[MOD_EXP_CTIME_STORAGE_LEN]);
 
-inline int rsaz_avx2_capable(void) { return CRYPTO_is_AVX2_capable(); }
+inline int rsaz_avx2_capable() { return bssl::CRYPTO_is_AVX2_capable(); }
 
-inline int rsaz_avx2_preferred(void) {
-  if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
-      CRYPTO_is_ADX_capable()) {
+inline int rsaz_avx2_preferred() {
+  if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
+      bssl::CRYPTO_is_ADX_capable()) {
     // If BMI1, BMI2, and ADX are available, x86_64-mont5.pl is faster. See the
     // .Lmulx4x_enter and .Lpowerx5_enter branches.
     return 0;
   }
-  return CRYPTO_is_AVX2_capable();
+  return bssl::CRYPTO_is_AVX2_capable();
 }
 
 
@@ -64,48 +62,48 @@ inline int rsaz_avx2_preferred(void) {
 //
 // See crypto/bn/asm/rsaz-avx2.pl for further details.
 
-// rsaz_1024_norm2red_avx2 converts |norm| from |BIGNUM| to RSAZ representation
-// and writes the result to |red|.
-void rsaz_1024_norm2red_avx2(BN_ULONG red[40], const BN_ULONG norm[16]);
-
-// rsaz_1024_mul_avx2 computes |a| * |b| mod |n| and writes the result to |ret|.
-// Inputs and outputs are in Montgomery form, using RSAZ's representation. |k|
-// is -|n|^-1 mod 2^64 or |n0| from |BN_MONT_CTX|.
-void rsaz_1024_mul_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
-                        const BN_ULONG b[40], const BN_ULONG n[40], BN_ULONG k);
-
-// rsaz_1024_mul_avx2 computes |a|^(2*|count|) mod |n| and writes the result to
-// |ret|. Inputs and outputs are in Montgomery form, using RSAZ's
-// representation. |k| is -|n|^-1 mod 2^64 or |n0| from |BN_MONT_CTX|.
-void rsaz_1024_sqr_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
-                        const BN_ULONG n[40], BN_ULONG k, int count);
-
-// rsaz_1024_scatter5_avx2 stores |val| at index |i| of |tbl|. |i| must be
+// rsaz_1024_norm2red_avx2 converts `norm` from `BIGNUM` to RSAZ representation
+// and writes the result to `red`.
+extern "C" void rsaz_1024_norm2red_avx2(BN_ULONG red[40],
+                                        const BN_ULONG norm[16]);
+
+// rsaz_1024_mul_avx2 computes `a` * `b` mod `n` and writes the result to `ret`.
+// Inputs and outputs are in Montgomery form, using RSAZ's representation. `k`
+// is -`n`^-1 mod 2^64 or `n0` from `BN_MONT_CTX`.
+extern "C" void rsaz_1024_mul_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
+                                   const BN_ULONG b[40], const BN_ULONG n[40],
+                                   BN_ULONG k);
+
+// rsaz_1024_mul_avx2 computes `a`^(2*`count`) mod `n` and writes the result to
+// `ret`. Inputs and outputs are in Montgomery form, using RSAZ's
+// representation. `k` is -`n`^-1 mod 2^64 or `n0` from `BN_MONT_CTX`.
+extern "C" void rsaz_1024_sqr_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
+                                   const BN_ULONG n[40], BN_ULONG k, int count);
+
+// rsaz_1024_scatter5_avx2 stores `val` at index `i` of `tbl`. `i` must be
 // positive and at most 31. It is treated as public. Note the table only uses 18
-// |BN_ULONG|s per entry instead of 40. It packs two 29-bit limbs into each
-// |BN_ULONG| and only stores 36 limbs rather than the padded 40.
-void rsaz_1024_scatter5_avx2(BN_ULONG tbl[32 * 18], const BN_ULONG val[40],
-                             int i);
+// `BN_ULONG`s per entry instead of 40. It packs two 29-bit limbs into each
+// `BN_ULONG` and only stores 36 limbs rather than the padded 40.
+extern "C" void rsaz_1024_scatter5_avx2(BN_ULONG tbl[32 * 18],
+                                        const BN_ULONG val[40], int i);
 
-// rsaz_1024_gather5_avx2 loads index |i| of |tbl| and writes it to |val|. |i|
-// must be positive and at most 31. It is treated as secret. |tbl| must be
+// rsaz_1024_gather5_avx2 loads index `i` of `tbl` and writes it to `val`. `i`
+// must be positive and at most 31. It is treated as secret. `tbl` must be
 // aligned to 32 bytes.
-void rsaz_1024_gather5_avx2(BN_ULONG val[40], const BN_ULONG tbl[32 * 18],
-                            int i);
+extern "C" void rsaz_1024_gather5_avx2(BN_ULONG val[40],
+                                       const BN_ULONG tbl[32 * 18], int i);
 
-// rsaz_1024_red2norm_avx2 converts |red| from RSAZ to |BIGNUM| representation
-// and writes the result to |norm|. The result will be <= the modulus.
+// rsaz_1024_red2norm_avx2 converts `red` from RSAZ to `BIGNUM` representation
+// and writes the result to `norm`. The result will be <= the modulus.
 //
-// WARNING: The result of this operation may not be fully reduced. |norm| may be
+// WARNING: The result of this operation may not be fully reduced. `norm` may be
 // the modulus instead of zero. This function should be followed by a call to
-// |bn_reduce_once|.
-void rsaz_1024_red2norm_avx2(BN_ULONG norm[16], const BN_ULONG red[40]);
-
+// `bn_reduce_once`.
+extern "C" void rsaz_1024_red2norm_avx2(BN_ULONG norm[16],
+                                        const BN_ULONG red[40]);
 
 #endif  // !OPENSSL_NO_ASM && OPENSSL_X86_64
 
-#if defined(__cplusplus)
-}  // extern "C"
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/shift.cc.inc

@@ -22,6 +22,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 int BN_lshift(BIGNUM *r, const BIGNUM *a, int n) {
   int i, nw, lb, rb;
   BN_ULONG *t, *f;
@@ -91,8 +93,8 @@ int BN_lshift1(BIGNUM *r, const BIGNUM *a) {
   return 1;
 }
 
-void bn_rshift_words(BN_ULONG *r, const BN_ULONG *a, unsigned shift,
-                     size_t num) {
+void bssl::bn_rshift_words(BN_ULONG *r, const BN_ULONG *a, unsigned shift,
+                           size_t num) {
   unsigned shift_bits = shift % BN_BITS2;
   size_t shift_words = shift / BN_BITS2;
   if (shift_words >= num) {
@@ -127,14 +129,13 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) {
   return 1;
 }
 
-int bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
-                           BN_CTX *ctx) {
-  int ret = 0;
-  BN_CTX_start(ctx);
+int bssl::bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
+                                 BN_CTX *ctx) {
+  BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   unsigned max_bits;
-  if (tmp == NULL || !BN_copy(r, a) || !bn_wexpand(tmp, r->width)) {
-    goto err;
+  if (tmp == nullptr || !BN_copy(r, a) || !bn_wexpand(tmp, r->width)) {
+    return 0;
   }
 
   // Shift conditionally by powers of two.
@@ -147,14 +148,10 @@ int bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
                     r->d /* ignore shift */, r->width);
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
-void bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) {
+void bssl::bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) {
   if (num == 0) {
     return;
   }
@@ -215,7 +212,7 @@ int BN_clear_bit(BIGNUM *a, int n) {
   return 1;
 }
 
-int bn_is_bit_set_words(const BN_ULONG *a, size_t num, size_t bit) {
+int bssl::bn_is_bit_set_words(const BN_ULONG *a, size_t num, size_t bit) {
   size_t i = bit / BN_BITS2;
   size_t j = bit % BN_BITS2;
   if (i >= num) {
@@ -266,7 +263,7 @@ static int bn_count_low_zero_bits_word(BN_ULONG l) {
   int bits = 0;
 
 #if BN_BITS2 > 32
-  // Check if the lower half of |x| are all zero.
+  // Check if the lower half of `x` are all zero.
   mask = constant_time_is_zero_w(l << (BN_BITS2 - 32));
   // If the lower half is all zeros, it is included in the bit count and we
   // count the upper half. Otherwise, we count the lower half.
@@ -314,7 +311,7 @@ int BN_count_low_zero_bits(const BIGNUM *bn) {
     ret |= first_nonzero & (i * BN_BITS2 + bits);
   }
 
-  // If got to the end of |bn| and saw no non-zero words, |bn| is zero. |ret|
+  // If got to the end of `bn` and saw no non-zero words, `bn` is zero. `ret`
   // will then remain zero.
   return ret;
 }

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/sqrt.cc.inc

@@ -19,6 +19,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
   // Compute a square root of |a| mod |p| using the Tonelli/Shanks algorithm
   // (cf. Henri Cohen, "A Course in Algebraic Computational Number Theory",
@@ -32,52 +34,50 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
 
   if (!BN_is_odd(p) || BN_abs_is_word(p, 1)) {
     if (BN_abs_is_word(p, 2)) {
-      if (ret == NULL) {
+      if (ret == nullptr) {
         ret = BN_new();
       }
-      if (ret == NULL ||
-          !BN_set_word(ret, BN_is_bit_set(a, 0))) {
+      if (ret == nullptr || !BN_set_word(ret, BN_is_bit_set(a, 0))) {
         if (ret != in) {
           BN_free(ret);
         }
-        return NULL;
+        return nullptr;
       }
       return ret;
     }
 
     OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
-    return NULL;
+    return nullptr;
   }
 
   if (BN_is_zero(a) || BN_is_one(a)) {
-    if (ret == NULL) {
+    if (ret == nullptr) {
       ret = BN_new();
     }
-    if (ret == NULL ||
-        !BN_set_word(ret, BN_is_one(a))) {
+    if (ret == nullptr || !BN_set_word(ret, BN_is_one(a))) {
       if (ret != in) {
         BN_free(ret);
       }
-      return NULL;
+      return nullptr;
     }
     return ret;
   }
 
-  BN_CTX_start(ctx);
+  BN_CTXScope scope(ctx);
   A = BN_CTX_get(ctx);
   b = BN_CTX_get(ctx);
   q = BN_CTX_get(ctx);
   t = BN_CTX_get(ctx);
   x = BN_CTX_get(ctx);
   y = BN_CTX_get(ctx);
-  if (y == NULL) {
+  if (y == nullptr) {
     goto end;
   }
 
-  if (ret == NULL) {
+  if (ret == nullptr) {
     ret = BN_new();
   }
-  if (ret == NULL) {
+  if (ret == nullptr) {
     goto end;
   }
 
@@ -104,8 +104,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
       goto end;
     }
     q->neg = 0;
-    if (!BN_add_word(q, 1) ||
-        !BN_mod_exp_mont(ret, A, q, p, ctx, NULL)) {
+    if (!BN_add_word(q, 1) || !BN_mod_exp_mont(ret, A, q, p, ctx, nullptr)) {
       goto end;
     }
     err = 0;
@@ -149,7 +148,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
       goto end;
     }
     q->neg = 0;
-    if (!BN_mod_exp_mont(b, t, q, p, ctx, NULL)) {
+    if (!BN_mod_exp_mont(b, t, q, p, ctx, nullptr)) {
       goto end;
     }
 
@@ -192,20 +191,9 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
         goto end;
       }
     } else {
-      if (!BN_pseudo_rand(y, BN_num_bits(p), 0, 0)) {
+      if (!BN_rand_range_ex(y, 22, p)) {
         goto end;
       }
-      if (BN_ucmp(y, p) >= 0) {
-        if (BN_usub(y, y, p)) {
-          goto end;
-        }
-      }
-      // now 0 <= y < |p|
-      if (BN_is_zero(y)) {
-        if (!BN_set_word(y, i)) {
-          goto end;
-        }
-      }
     }
 
     r = bn_jacobi(y, q, ctx);  // here 'q' is |p|
@@ -235,7 +223,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
 
   // Now that we have some non-square, we can find an element
   // of order  2^e  by computing its q'th power.
-  if (!BN_mod_exp_mont(y, y, q, p, ctx, NULL)) {
+  if (!BN_mod_exp_mont(y, y, q, p, ctx, nullptr)) {
     goto end;
   }
   if (BN_is_one(y)) {
@@ -279,7 +267,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
       goto end;
     }
   } else {
-    if (!BN_mod_exp_mont(x, A, t, p, ctx, NULL)) {
+    if (!BN_mod_exp_mont(x, A, t, p, ctx, nullptr)) {
       goto end;
     }
     if (BN_is_zero(x)) {
@@ -376,84 +364,7 @@ end:
     if (ret != in) {
       BN_clear_free(ret);
     }
-    ret = NULL;
+    ret = nullptr;
   }
-  BN_CTX_end(ctx);
   return ret;
 }
-
-int BN_sqrt(BIGNUM *out_sqrt, const BIGNUM *in, BN_CTX *ctx) {
-  BIGNUM *estimate, *tmp, *delta, *last_delta, *tmp2;
-  int ok = 0, last_delta_valid = 0;
-
-  if (in->neg) {
-    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
-    return 0;
-  }
-  if (BN_is_zero(in)) {
-    BN_zero(out_sqrt);
-    return 1;
-  }
-
-  BN_CTX_start(ctx);
-  if (out_sqrt == in) {
-    estimate = BN_CTX_get(ctx);
-  } else {
-    estimate = out_sqrt;
-  }
-  tmp = BN_CTX_get(ctx);
-  last_delta = BN_CTX_get(ctx);
-  delta = BN_CTX_get(ctx);
-  if (estimate == NULL || tmp == NULL || last_delta == NULL || delta == NULL) {
-    goto err;
-  }
-
-  // We estimate that the square root of an n-bit number is 2^{n/2}.
-  if (!BN_lshift(estimate, BN_value_one(), BN_num_bits(in)/2)) {
-    goto err;
-  }
-
-  // This is Newton's method for finding a root of the equation |estimate|^2 -
-  // |in| = 0.
-  for (;;) {
-    // |estimate| = 1/2 * (|estimate| + |in|/|estimate|)
-    if (!BN_div(tmp, NULL, in, estimate, ctx) ||
-        !BN_add(tmp, tmp, estimate) ||
-        !BN_rshift1(estimate, tmp) ||
-        // |tmp| = |estimate|^2
-        !BN_sqr(tmp, estimate, ctx) ||
-        // |delta| = |in| - |tmp|
-        !BN_sub(delta, in, tmp)) {
-      OPENSSL_PUT_ERROR(BN, ERR_R_BN_LIB);
-      goto err;
-    }
-
-    delta->neg = 0;
-    // The difference between |in| and |estimate| squared is required to always
-    // decrease. This ensures that the loop always terminates, but I don't have
-    // a proof that it always finds the square root for a given square.
-    if (last_delta_valid && BN_cmp(delta, last_delta) >= 0) {
-      break;
-    }
-
-    last_delta_valid = 1;
-
-    tmp2 = last_delta;
-    last_delta = delta;
-    delta = tmp2;
-  }
-
-  if (BN_cmp(tmp, in) != 0) {
-    OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
-    goto err;
-  }
-
-  ok = 1;
-
-err:
-  if (ok && out_sqrt == in && !BN_copy(out_sqrt, estimate)) {
-    ok = 0;
-  }
-  BN_CTX_end(ctx);
-  return ok;
-}