/* $OpenBSD: bn_lib.c,v 1.93 2024/04/16 13:07:14 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 *
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 *
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <assert.h>
#include <limits.h>
#include <stdio.h>
#include <string.h>

#include <openssl/opensslconf.h>

#include <openssl/err.h>

#include "bn_local.h"
#include "bn_internal.h"

BIGNUM *
BN_new(void)
{
	BIGNUM *bn;

	if ((bn = calloc(1, sizeof(BIGNUM))) == NULL) {
		BNerror(ERR_R_MALLOC_FAILURE);
		return NULL;
	}
	bn->flags = BN_FLG_MALLOCED;

	return bn;
}
LCRYPTO_ALIAS(BN_new);

void
BN_init(BIGNUM *a)
{
	memset(a, 0, sizeof(BIGNUM));
}

void
BN_clear(BIGNUM *a)
{
	if (a->d != NULL)
		explicit_bzero(a->d, a->dmax * sizeof(a->d[0]));
	a->top = 0;
	a->neg = 0;
}
LCRYPTO_ALIAS(BN_clear);

void
BN_free(BIGNUM *bn)
{
	if (bn == NULL)
		return;

	if (!BN_get_flags(bn, BN_FLG_STATIC_DATA))
		freezero(bn->d, bn->dmax * sizeof(bn->d[0]));

	if (!BN_get_flags(bn, BN_FLG_MALLOCED)) {
		explicit_bzero(bn, sizeof(*bn));
		return;
	}

	freezero(bn, sizeof(*bn));
}
LCRYPTO_ALIAS(BN_free);

void
BN_clear_free(BIGNUM *bn)
{
	BN_free(bn);
}
LCRYPTO_ALIAS(BN_clear_free);

void
BN_set_flags(BIGNUM *b, int n)
{
	b->flags |= n;
}
LCRYPTO_ALIAS(BN_set_flags);

int
BN_get_flags(const BIGNUM *b, int n)
{
	return b->flags & n;
}
LCRYPTO_ALIAS(BN_get_flags);

void
BN_with_flags(BIGNUM *dest, const BIGNUM *b, int flags)
{
	int dest_flags;

	dest_flags = (dest->flags & BN_FLG_MALLOCED) |
	    (b->flags & ~BN_FLG_MALLOCED) | BN_FLG_STATIC_DATA | flags;

	*dest = *b;
	dest->flags = dest_flags;
}
LCRYPTO_ALIAS(BN_with_flags);

static const BN_ULONG bn_value_one_data = 1;
static const BIGNUM bn_value_one = {
	.d = (BN_ULONG *)&bn_value_one_data,
	.top = 1,
	.dmax = 1,
	.neg = 0,
	.flags = BN_FLG_STATIC_DATA,
};

const BIGNUM *
BN_value_one(void)
{
	return &bn_value_one;
}
LCRYPTO_ALIAS(BN_value_one);

int
BN_num_bits_word(BN_ULONG w)
{
	return BN_BITS2 - bn_clzw(w);
}
LCRYPTO_ALIAS(BN_num_bits_word);

int
BN_num_bits(const BIGNUM *bn)
{
	return bn_bitsize(bn);
}
LCRYPTO_ALIAS(BN_num_bits);

void
bn_correct_top(BIGNUM *a)
{
	while (a->top > 0 && a->d[a->top - 1] == 0)
		a->top--;
}

static int
bn_expand_internal(BIGNUM *bn, int words)
{
	BN_ULONG *d;

	if (words < 0) {
		BNerror(BN_R_BIGNUM_TOO_LONG); // XXX
		return 0;
	}

	if (words > INT_MAX / (4 * BN_BITS2)) {
		BNerror(BN_R_BIGNUM_TOO_LONG);
		return 0;
	}
	if (BN_get_flags(bn, BN_FLG_STATIC_DATA)) {
		BNerror(BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
		return 0;
	}

	d = recallocarray(bn->d, bn->dmax, words, sizeof(BN_ULONG));
	if (d == NULL) {
		BNerror(ERR_R_MALLOC_FAILURE);
		return 0;
	}
	bn->d = d;
	bn->dmax = words;

	return 1;
}

int
bn_expand_bits(BIGNUM *bn, size_t bits)
{
	int words;

	if (bits > (INT_MAX - BN_BITS2 + 1))
		return 0;

	words = (bits + BN_BITS2 - 1) / BN_BITS2;

	return bn_wexpand(bn, words);
}

int
bn_expand_bytes(BIGNUM *bn, size_t bytes)
{
	int words;

	if (bytes > (INT_MAX - BN_BYTES + 1))
		return 0;

	words = (bytes + BN_BYTES - 1) / BN_BYTES;

	return bn_wexpand(bn, words);
}

int
bn_wexpand(BIGNUM *bn, int words)
{
	if (words < 0)
		return 0;

	if (words <= bn->dmax)
		return 1;

	return bn_expand_internal(bn, words);
}

BIGNUM *
BN_dup(const BIGNUM *a)
{
	BIGNUM *t;

	if (a == NULL)
		return NULL;

	t = BN_new();
	if (t == NULL)
		return NULL;
	if (!bn_copy(t, a)) {
		BN_free(t);
		return NULL;
	}
	return t;
}
LCRYPTO_ALIAS(BN_dup);

static inline void
bn_copy_words(BN_ULONG *ap, const BN_ULONG *bp, int n)
{
	while (n > 0) {
		ap[0] = bp[0];
		ap++;
		bp++;
		n--;
	}
}

BIGNUM *
BN_copy(BIGNUM *a, const BIGNUM *b)
{
	if (a == b)
		return (a);

	if (!bn_wexpand(a, b->top))
		return (NULL);

	bn_copy_words(a->d, b->d, b->top);

	/* Copy constant time flag from b, but make it sticky on a. */
	a->flags |= b->flags & BN_FLG_CONSTTIME;

	a->top = b->top;
	a->neg = b->neg;

	return (a);
}
LCRYPTO_ALIAS(BN_copy);

int
bn_copy(BIGNUM *dst, const BIGNUM *src)
{
	return BN_copy(dst, src) != NULL;
}

void
BN_swap(BIGNUM *a, BIGNUM *b)
{
	int flags_old_a, flags_old_b;
	BN_ULONG *tmp_d;
	int tmp_top, tmp_dmax, tmp_neg;


	flags_old_a = a->flags;
	flags_old_b = b->flags;

	tmp_d = a->d;
	tmp_top = a->top;
	tmp_dmax = a->dmax;
	tmp_neg = a->neg;

	a->d = b->d;
	a->top = b->top;
	a->dmax = b->dmax;
	a->neg = b->neg;

	b->d = tmp_d;
	b->top = tmp_top;
	b->dmax = tmp_dmax;
	b->neg = tmp_neg;

	a->flags = (flags_old_a & BN_FLG_MALLOCED) |
	    (flags_old_b & BN_FLG_STATIC_DATA);
	b->flags = (flags_old_b & BN_FLG_MALLOCED) |
	    (flags_old_a & BN_FLG_STATIC_DATA);
}
LCRYPTO_ALIAS(BN_swap);

BN_ULONG
BN_get_word(const BIGNUM *a)
{
	if (a->top > 1)
		return BN_MASK2;
	else if (a->top == 1)
		return a->d[0];
	/* a->top == 0 */
	return 0;
}
LCRYPTO_ALIAS(BN_get_word);

int
BN_set_word(BIGNUM *a, BN_ULONG w)
{
	if (!bn_wexpand(a, 1))
		return (0);
	a->neg = 0;
	a->d[0] = w;
	a->top = (w ? 1 : 0);
	return (1);
}
LCRYPTO_ALIAS(BN_set_word);

int
BN_ucmp(const BIGNUM *a, const BIGNUM *b)
{
	int i;

	if (a->top < b->top)
		return -1;
	if (a->top > b->top)
		return 1;

	for (i = a->top - 1; i >= 0; i--) {
		if (a->d[i] != b->d[i])
			return (a->d[i] > b->d[i] ? 1 : -1);
	}

	return 0;
}
LCRYPTO_ALIAS(BN_ucmp);

int
BN_cmp(const BIGNUM *a, const BIGNUM *b)
{
	if (a == NULL || b == NULL) {
		if (a != NULL)
			return -1;
		if (b != NULL)
			return 1;
		return 0;
	}

	if (a->neg != b->neg)
		return b->neg - a->neg;

	if (a->neg)
		return BN_ucmp(b, a);

	return BN_ucmp(a, b);
}
LCRYPTO_ALIAS(BN_cmp);

int
BN_set_bit(BIGNUM *a, int n)
{
	int i, j, k;

	if (n < 0)
		return 0;

	i = n / BN_BITS2;
	j = n % BN_BITS2;
	if (a->top <= i) {
		if (!bn_wexpand(a, i + 1))
			return (0);
		for (k = a->top; k < i + 1; k++)
			a->d[k] = 0;
		a->top = i + 1;
	}

	a->d[i] |= (((BN_ULONG)1) << j);
	return (1);
}
LCRYPTO_ALIAS(BN_set_bit);

int
BN_clear_bit(BIGNUM *a, int n)
{
	int i, j;

	if (n < 0)
		return 0;

	i = n / BN_BITS2;
	j = n % BN_BITS2;
	if (a->top <= i)
		return (0);

	a->d[i] &= (~(((BN_ULONG)1) << j));
	bn_correct_top(a);

	BN_set_negative(a, a->neg);

	return (1);
}
LCRYPTO_ALIAS(BN_clear_bit);

int
BN_is_bit_set(const BIGNUM *a, int n)
{
	int i, j;

	if (n < 0)
		return 0;
	i = n / BN_BITS2;
	j = n % BN_BITS2;
	if (a->top <= i)
		return 0;
	return (int)(((a->d[i]) >> j) & ((BN_ULONG)1));
}
LCRYPTO_ALIAS(BN_is_bit_set);

int
BN_mask_bits(BIGNUM *a, int n)
{
	int b, w;

	if (n < 0)
		return 0;

	w = n / BN_BITS2;
	b = n % BN_BITS2;
	if (w >= a->top)
		return 0;
	if (b == 0)
		a->top = w;
	else {
		a->top = w + 1;
		a->d[w] &= ~(BN_MASK2 << b);
	}
	bn_correct_top(a);

	BN_set_negative(a, a->neg);

	return (1);
}
LCRYPTO_ALIAS(BN_mask_bits);

void
BN_set_negative(BIGNUM *bn, int neg)
{
	bn->neg = ~BN_is_zero(bn) & bn_ct_ne_zero(neg);
}
LCRYPTO_ALIAS(BN_set_negative);

/*
 * Constant-time conditional swap of a and b.
 * a and b are swapped if condition is not 0.
 * The code assumes that at most one bit of condition is set.
 * nwords is the number of words to swap.
 * The code assumes that at least nwords are allocated in both a and b,
 * and that no more than nwords are used by either a or b.
 * a and b cannot be the same number
 */
void
BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
{
	BN_ULONG t;
	int i;

	assert(a != b);
	assert((condition & (condition - 1)) == 0);
	assert(sizeof(BN_ULONG) >= sizeof(int));

	condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;

	t = (a->top^b->top) & condition;
	a->top ^= t;
	b->top ^= t;

#define BN_CONSTTIME_SWAP(ind) \
	do { \
		t = (a->d[ind] ^ b->d[ind]) & condition; \
		a->d[ind] ^= t; \
		b->d[ind] ^= t; \
	} while (0)


	switch (nwords) {
	default:
		for (i = 10; i < nwords; i++)
			BN_CONSTTIME_SWAP(i);
		/* Fallthrough */
	case 10: BN_CONSTTIME_SWAP(9); /* Fallthrough */
	case 9: BN_CONSTTIME_SWAP(8); /* Fallthrough */
	case 8: BN_CONSTTIME_SWAP(7); /* Fallthrough */
	case 7: BN_CONSTTIME_SWAP(6); /* Fallthrough */
	case 6: BN_CONSTTIME_SWAP(5); /* Fallthrough */
	case 5: BN_CONSTTIME_SWAP(4); /* Fallthrough */
	case 4: BN_CONSTTIME_SWAP(3); /* Fallthrough */
	case 3: BN_CONSTTIME_SWAP(2); /* Fallthrough */
	case 2: BN_CONSTTIME_SWAP(1); /* Fallthrough */
	case 1:
		BN_CONSTTIME_SWAP(0);
	}
#undef BN_CONSTTIME_SWAP
}
LCRYPTO_ALIAS(BN_consttime_swap);

/*
 * Constant-time conditional swap of a and b.
 * a and b are swapped if condition is not 0.
 * nwords is the number of words to swap.
 */
int
BN_swap_ct(BN_ULONG condition, BIGNUM *a, BIGNUM *b, size_t nwords)
{
	BN_ULONG t;
	int i, words;

	if (a == b)
		return 1;
	if (nwords > INT_MAX)
		return 0;
	words = (int)nwords;
	if (!bn_wexpand(a, words) || !bn_wexpand(b, words))
		return 0;
	if (a->top > words || b->top > words) {
		BNerror(BN_R_INVALID_LENGTH);
		return 0;
	}

	/* Set condition to 0 (if it was zero) or all 1s otherwise. */
	condition = ((~condition & (condition - 1)) >> (BN_BITS2 - 1)) - 1;

	/* swap top field */
	t = (a->top ^ b->top) & condition;
	a->top ^= t;
	b->top ^= t;

	/* swap neg field */
	t = (a->neg ^ b->neg) & condition;
	a->neg ^= t;
	b->neg ^= t;

	/* swap BN_FLG_CONSTTIME from flag field */
	t = ((a->flags ^ b->flags) & BN_FLG_CONSTTIME) & condition;
	a->flags ^= t;
	b->flags ^= t;

	/* swap the data */
	for (i = 0; i < words; i++) {
		t = (a->d[i] ^ b->d[i]) & condition;
		a->d[i] ^= t;
		b->d[i] ^= t;
	}

	return 1;
}

void
BN_zero(BIGNUM *a)
{
	a->neg = 0;
	a->top = 0;
}
LCRYPTO_ALIAS(BN_zero);

int
BN_one(BIGNUM *a)
{
	return BN_set_word(a, 1);
}
LCRYPTO_ALIAS(BN_one);

int
BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
{
	return (a->top == 1 && a->d[0] == w) || (w == 0 && a->top == 0);
}
LCRYPTO_ALIAS(BN_abs_is_word);

int
BN_is_zero(const BIGNUM *bn)
{
	BN_ULONG bits = 0;
	int i;

	for (i = 0; i < bn->top; i++)
		bits |= bn->d[i];

	return bits == 0;
}
LCRYPTO_ALIAS(BN_is_zero);

int
BN_is_one(const BIGNUM *a)
{
	return BN_abs_is_word(a, 1) && !a->neg;
}
LCRYPTO_ALIAS(BN_is_one);

int
BN_is_word(const BIGNUM *a, const BN_ULONG w)
{
	return BN_abs_is_word(a, w) && (w == 0 || !a->neg);
}
LCRYPTO_ALIAS(BN_is_word);

int
BN_is_odd(const BIGNUM *a)
{
	return a->top > 0 && (a->d[0] & 1);
}
LCRYPTO_ALIAS(BN_is_odd);

int
BN_is_negative(const BIGNUM *a)
{
	return a->neg != 0;
}
LCRYPTO_ALIAS(BN_is_negative);

/*
 * Bits of security, see SP800-57, section 5.6.11, table 2.
 */
int
BN_security_bits(int L, int N)
{
	int secbits, bits;

	if (L >= 15360)
		secbits = 256;
	else if (L >= 7680)
		secbits = 192;
	else if (L >= 3072)
		secbits = 128;
	else if (L >= 2048)
		secbits = 112;
	else if (L >= 1024)
		secbits = 80;
	else
		return 0;

	if (N == -1)
		return secbits;

	bits = N / 2;
	if (bits < 80)
		return 0;

	return bits >= secbits ? secbits : bits;
}
LCRYPTO_ALIAS(BN_security_bits);

BN_GENCB *
BN_GENCB_new(void)
{
	BN_GENCB *cb;

	if ((cb = calloc(1, sizeof(*cb))) == NULL)
		return NULL;

	return cb;
}
LCRYPTO_ALIAS(BN_GENCB_new);

void
BN_GENCB_free(BN_GENCB *cb)
{
	if (cb == NULL)
		return;
	free(cb);
}
LCRYPTO_ALIAS(BN_GENCB_free);

/* Populate a BN_GENCB structure with an "old"-style callback */
void
BN_GENCB_set_old(BN_GENCB *gencb, void (*cb)(int, int, void *), void *cb_arg)
{
	gencb->ver = 1;
	gencb->cb.cb_1 = cb;
	gencb->arg = cb_arg;
}
LCRYPTO_ALIAS(BN_GENCB_set_old);

/* Populate a BN_GENCB structure with a "new"-style callback */
void
BN_GENCB_set(BN_GENCB *gencb, int (*cb)(int, int, BN_GENCB *), void *cb_arg)
{
	gencb->ver = 2;
	gencb->cb.cb_2 = cb;
	gencb->arg = cb_arg;
}
LCRYPTO_ALIAS(BN_GENCB_set);

void *
BN_GENCB_get_arg(BN_GENCB *cb)
{
	return cb->arg;
}
LCRYPTO_ALIAS(BN_GENCB_get_arg);