Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	lib/libcrypto/dsa/dsa_gen.c	Lines:	114	164	69.5 %
Date:	2017-11-13	Branches:	84	146	57.5 %


/* $OpenBSD: dsa_gen.c,v 1.24 2017/01/21 10:38:29 beck Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 *
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 *
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_SHA is defined */

#ifndef OPENSSL_NO_SHA

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <openssl/bn.h>
#include <openssl/evp.h>
#include <openssl/sha.h>

#include "bn_lcl.h"
#include "dsa_locl.h"

int
DSA_generate_parameters_ex(DSA *ret, int bits, const unsigned char *seed_in,
    int seed_len, int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
{
	if (ret->meth->dsa_paramgen)
		return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
		    counter_ret, h_ret, cb);
	else {
		const EVP_MD *evpmd;
		size_t qbits;

		if (bits >= 2048) {
			qbits = 256;
			evpmd = EVP_sha256();
		} else {
			qbits = 160;
			evpmd = EVP_sha1();
		}

		return dsa_builtin_paramgen(ret, bits, qbits, evpmd, seed_in,
		    seed_len, NULL, counter_ret, h_ret, cb);
	}
}

int
dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits, const EVP_MD *evpmd,
    const unsigned char *seed_in, size_t seed_len, unsigned char *seed_out,
    int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
{
	int ok = 0;
	unsigned char seed[SHA256_DIGEST_LENGTH];
	unsigned char md[SHA256_DIGEST_LENGTH];
	unsigned char buf[SHA256_DIGEST_LENGTH], buf2[SHA256_DIGEST_LENGTH];
	BIGNUM *r0, *W, *X, *c, *test;
	BIGNUM *g = NULL, *q = NULL, *p = NULL;
	BN_MONT_CTX *mont = NULL;
	int i, k, n = 0, m = 0, qsize = qbits >> 3;
	int counter = 0;
	int r = 0;
	BN_CTX *ctx = NULL;
	unsigned int h = 2;

	if (qsize != SHA_DIGEST_LENGTH && qsize != SHA224_DIGEST_LENGTH &&
	    qsize != SHA256_DIGEST_LENGTH)
		/* invalid q size */
		return 0;

	if (evpmd == NULL)
		/* use SHA1 as default */
		evpmd = EVP_sha1();

	if (bits < 512)
		bits = 512;

	bits = (bits + 63) / 64 * 64;

	if (seed_len < (size_t)qsize) {
		seed_in = NULL;		/* seed buffer too small -- ignore */
		seed_len = 0;
	}
	/*
	 * App. 2.2 of FIPS PUB 186 allows larger SEED,
	 * but our internal buffers are restricted to 160 bits
	 */
	if (seed_len > (size_t)qsize)
		seed_len = qsize;
	if (seed_in != NULL)
		memcpy(seed, seed_in, seed_len);
	else if (seed_len != 0)
		goto err;

	if ((mont=BN_MONT_CTX_new()) == NULL)
		goto err;

	if ((ctx=BN_CTX_new()) == NULL)
		goto err;
	BN_CTX_start(ctx);

	if ((r0 = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((g = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((W = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((q = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((X = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((c = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((p = BN_CTX_get(ctx)) == NULL)
		goto err;
	if ((test = BN_CTX_get(ctx)) == NULL)
		goto err;

	if (!BN_lshift(test, BN_value_one(), bits - 1))
		goto err;

	for (;;) {
		for (;;) { /* find q */
			int seed_is_random;

			/* step 1 */
			if (!BN_GENCB_call(cb, 0, m++))
				goto err;

			if (seed_len == 0) {
				arc4random_buf(seed, qsize);
				seed_is_random = 1;
			} else {
				seed_is_random = 0;
				/* use random seed if 'seed_in' turns out
				   to be bad */
				seed_len = 0;
			}
			memcpy(buf, seed, qsize);
			memcpy(buf2, seed, qsize);
			/* precompute "SEED + 1" for step 7: */
			for (i = qsize - 1; i >= 0; i--) {
				buf[i]++;
				if (buf[i] != 0)
					break;
			}

			/* step 2 */
			if (!EVP_Digest(seed, qsize, md,   NULL, evpmd, NULL))
				goto err;
			if (!EVP_Digest(buf,  qsize, buf2, NULL, evpmd, NULL))
				goto err;
			for (i = 0; i < qsize; i++)
				md[i] ^= buf2[i];

			/* step 3 */
			md[0] |= 0x80;
			md[qsize - 1] |= 0x01;
			if (!BN_bin2bn(md, qsize, q))
				goto err;

			/* step 4 */
			r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
			    seed_is_random, cb);
			if (r > 0)
				break;
			if (r != 0)
				goto err;

			/* do a callback call */
			/* step 5 */
		}

		if (!BN_GENCB_call(cb, 2, 0))
			goto err;
		if (!BN_GENCB_call(cb, 3, 0))
			goto err;

		/* step 6 */
		counter = 0;
		/* "offset = 2" */

		n = (bits - 1) / 160;

		for (;;) {
			if (counter != 0 && !BN_GENCB_call(cb, 0, counter))
				goto err;

			/* step 7 */
			BN_zero(W);
			/* now 'buf' contains "SEED + offset - 1" */
			for (k = 0; k <= n; k++) {
				/* obtain "SEED + offset + k" by incrementing: */
				for (i = qsize - 1; i >= 0; i--) {
					buf[i]++;
					if (buf[i] != 0)
						break;
				}

				if (!EVP_Digest(buf, qsize, md ,NULL, evpmd,
				    NULL))
					goto err;

				/* step 8 */
				if (!BN_bin2bn(md, qsize, r0))
					goto err;
				if (!BN_lshift(r0, r0, (qsize << 3) * k))
					goto err;
				if (!BN_add(W, W, r0))
					goto err;
			}

			/* more of step 8 */
			if (!BN_mask_bits(W, bits - 1))
				goto err;
			if (!BN_copy(X, W))
				goto err;
			if (!BN_add(X, X, test))
				goto err;

			/* step 9 */
			if (!BN_lshift1(r0, q))
				goto err;
			if (!BN_mod_ct(c, X, r0, ctx))
				goto err;
			if (!BN_sub(r0, c, BN_value_one()))
				goto err;
			if (!BN_sub(p, X, r0))
				goto err;

			/* step 10 */
			if (BN_cmp(p, test) >= 0) {
				/* step 11 */
				r = BN_is_prime_fasttest_ex(p, DSS_prime_checks,
				    ctx, 1, cb);
				if (r > 0)
					goto end; /* found it */
				if (r != 0)
					goto err;
			}

			/* step 13 */
			counter++;
			/* "offset = offset + n + 1" */

			/* step 14 */
			if (counter >= 4096)
				break;
		}
	}
end:
	if (!BN_GENCB_call(cb, 2, 1))
		goto err;

	/* We now need to generate g */
	/* Set r0=(p-1)/q */
	if (!BN_sub(test, p, BN_value_one()))
		goto err;
	if (!BN_div_ct(r0, NULL, test, q, ctx))
		goto err;

	if (!BN_set_word(test, h))
		goto err;
	if (!BN_MONT_CTX_set(mont, p, ctx))
		goto err;

	for (;;) {
		/* g=test^r0%p */
		if (!BN_mod_exp_mont_ct(g, test, r0, p, ctx, mont))
			goto err;
		if (!BN_is_one(g))
			break;
		if (!BN_add(test, test, BN_value_one()))
			goto err;
		h++;
	}

	if (!BN_GENCB_call(cb, 3, 1))
		goto err;

	ok = 1;
err:
	if (ok) {
		BN_free(ret->p);
		BN_free(ret->q);
		BN_free(ret->g);
		ret->p = BN_dup(p);
		ret->q = BN_dup(q);
		ret->g = BN_dup(g);
		if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
			ok = 0;
			goto err;
		}
		if (counter_ret != NULL)
			*counter_ret = counter;
		if (h_ret != NULL)
			*h_ret = h;
		if (seed_out != NULL)
			memcpy(seed_out, seed, qsize);
	}
	if (ctx) {
		BN_CTX_end(ctx);
		BN_CTX_free(ctx);
	}
	BN_MONT_CTX_free(mont);
	return ok;
}
#endif


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: dsa_gen.c,v 1.24 2017/01/21 10:38:29 beck Exp $ */
2			/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3			* All rights reserved.
4			*
5			* This package is an SSL implementation written
6			* by Eric Young (eay@cryptsoft.com).
7			* The implementation was written so as to conform with Netscapes SSL.
8			*
9			* This library is free for commercial and non-commercial use as long as
10			* the following conditions are aheared to. The following conditions
11			* apply to all code found in this distribution, be it the RC4, RSA,
12			* lhash, DES, etc., code; not just the SSL code. The SSL documentation
13			* included with this distribution is covered by the same copyright terms
14			* except that the holder is Tim Hudson (tjh@cryptsoft.com).
15			*
16			* Copyright remains Eric Young's, and as such any Copyright notices in
17			* the code are not to be removed.
18			* If this package is used in a product, Eric Young should be given attribution
19			* as the author of the parts of the library used.
20			* This can be in the form of a textual message at program startup or
21			* in documentation (online or textual) provided with the package.
22			*
23			* Redistribution and use in source and binary forms, with or without
24			* modification, are permitted provided that the following conditions
25			* are met:
26			* 1. Redistributions of source code must retain the copyright
27			* notice, this list of conditions and the following disclaimer.
28			* 2. Redistributions in binary form must reproduce the above copyright
29			* notice, this list of conditions and the following disclaimer in the
30			* documentation and/or other materials provided with the distribution.
31			* 3. All advertising materials mentioning features or use of this software
32			* must display the following acknowledgement:
33			* "This product includes cryptographic software written by
34			* Eric Young (eay@cryptsoft.com)"
35			* The word 'cryptographic' can be left out if the rouines from the library
36			* being used are not cryptographic related :-).
37			* 4. If you include any Windows specific code (or a derivative thereof) from
38			* the apps directory (application code) you must include an acknowledgement:
39			* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40			*
41			* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42			* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43			* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44			* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45			* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46			* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47			* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48			* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49			* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50			* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51			* SUCH DAMAGE.
52			*
53			* The licence and distribution terms for any publically available version or
54			* derivative of this code cannot be changed. i.e. this code cannot simply be
55			* copied and put under another distribution licence
56			* [including the GNU Public Licence.]
57			*/
58
59			#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_SHA is defined */
60
61			#ifndef OPENSSL_NO_SHA
62
63			#include <stdio.h>
64			#include <stdlib.h>
65			#include <string.h>
66
67			#include <openssl/bn.h>
68			#include <openssl/evp.h>
69			#include <openssl/sha.h>
70
71			#include "bn_lcl.h"
72			#include "dsa_locl.h"
73
74			int
75			DSA_generate_parameters_ex(DSA ret, int bits, const unsigned char seed_in,
76			int seed_len, int counter_ret, unsigned long h_ret, BN_GENCB *cb)
77			{
78	✗✓	20	if (ret->meth->dsa_paramgen)
79			return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
80			counter_ret, h_ret, cb);
81			else {
82			const EVP_MD *evpmd;
83			size_t qbits;
84
85	✗✓	10	if (bits >= 2048) {
86			qbits = 256;
87			evpmd = EVP_sha256();
88			} else {
89			qbits = 160;
90		10	evpmd = EVP_sha1();
91			}
92
93		20	return dsa_builtin_paramgen(ret, bits, qbits, evpmd, seed_in,
94		10	seed_len, NULL, counter_ret, h_ret, cb);
95			}
96		10	}
97
98			int
99			dsa_builtin_paramgen(DSA ret, size_t bits, size_t qbits, const EVP_MD evpmd,
100			const unsigned char seed_in, size_t seed_len, unsigned char seed_out,
101			int counter_ret, unsigned long h_ret, BN_GENCB *cb)
102			{
103			int ok = 0;
104		24	unsigned char seed[SHA256_DIGEST_LENGTH];
105		12	unsigned char md[SHA256_DIGEST_LENGTH];
106		12	unsigned char buf[SHA256_DIGEST_LENGTH], buf2[SHA256_DIGEST_LENGTH];
107			BIGNUM r0, W, X, c, *test;
108			BIGNUM g = NULL, q = NULL, *p = NULL;
109			BN_MONT_CTX *mont = NULL;
110		12	int i, k, n = 0, m = 0, qsize = qbits >> 3;
111			int counter = 0;
112			int r = 0;
113			BN_CTX *ctx = NULL;
114			unsigned int h = 2;
115
116	✗✓	24	if (qsize != SHA_DIGEST_LENGTH && qsize != SHA224_DIGEST_LENGTH &&
117		12	qsize != SHA256_DIGEST_LENGTH)
118			/* invalid q size */
119			return 0;
120
121	✓✓	12	if (evpmd == NULL)
122			/* use SHA1 as default */
123		2	evpmd = EVP_sha1();
124
125	✗✓	12	if (bits < 512)
126			bits = 512;
127
128		12	bits = (bits + 63) / 64 * 64;
129
130	✓✓	12	if (seed_len < (size_t)qsize) {
131			seed_in = NULL; /* seed buffer too small -- ignore */
132			seed_len = 0;
133		6	}
134			/*
135			* App. 2.2 of FIPS PUB 186 allows larger SEED,
136			* but our internal buffers are restricted to 160 bits
137			*/
138	✗✓	12	if (seed_len > (size_t)qsize)
139			seed_len = qsize;
140	✓✓	12	if (seed_in != NULL)
141		6	memcpy(seed, seed_in, seed_len);
142	✗✓	6	else if (seed_len != 0)
143			goto err;
144
145	✗✓	12	if ((mont=BN_MONT_CTX_new()) == NULL)
146			goto err;
147
148	✗✓	12	if ((ctx=BN_CTX_new()) == NULL)
149			goto err;
150		12	BN_CTX_start(ctx);
151
152	✗✓	12	if ((r0 = BN_CTX_get(ctx)) == NULL)
153			goto err;
154	✗✓	12	if ((g = BN_CTX_get(ctx)) == NULL)
155			goto err;
156	✗✓	12	if ((W = BN_CTX_get(ctx)) == NULL)
157			goto err;
158	✗✓	12	if ((q = BN_CTX_get(ctx)) == NULL)
159			goto err;
160	✗✓	12	if ((X = BN_CTX_get(ctx)) == NULL)
161			goto err;
162	✗✓	12	if ((c = BN_CTX_get(ctx)) == NULL)
163			goto err;
164	✗✓	12	if ((p = BN_CTX_get(ctx)) == NULL)
165			goto err;
166	✗✓	12	if ((test = BN_CTX_get(ctx)) == NULL)
167			goto err;
168
169	✗✓	12	if (!BN_lshift(test, BN_value_one(), bits - 1))
170			goto err;
171
172		12	for (;;) {
173		161	for (;;) { /* find q */
174			int seed_is_random;
175
176			/* step 1 */
177	✗✓	161	if (!BN_GENCB_call(cb, 0, m++))
178			goto err;
179
180	✓✓	161	if (seed_len == 0) {
181		155	arc4random_buf(seed, qsize);
182			seed_is_random = 1;
183		155	} else {
184			seed_is_random = 0;
185			/* use random seed if 'seed_in' turns out
186			to be bad */
187			seed_len = 0;
188			}
189		161	memcpy(buf, seed, qsize);
190		161	memcpy(buf2, seed, qsize);
191			/* precompute "SEED + 1" for step 7: */
192	✓✗	322	for (i = qsize - 1; i >= 0; i--) {
193		161	buf[i]++;
194	✗✓	161	if (buf[i] != 0)
195			break;
196			}
197
198			/* step 2 */
199	✗✓	161	if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL))
200			goto err;
201	✗✓	161	if (!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL))
202			goto err;
203	✓✓	6762	for (i = 0; i < qsize; i++)
204		3220	md[i] ^= buf2[i];
205
206			/* step 3 */
207		161	md[0] \|= 0x80;
208		161	md[qsize - 1] \|= 0x01;
209	✗✓	161	if (!BN_bin2bn(md, qsize, q))
210			goto err;
211
212			/* step 4 */
213		161	r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
214			seed_is_random, cb);
215	✓✓	161	if (r > 0)
216		12	break;
217	✗✓	149	if (r != 0)
218			goto err;
219
220			/* do a callback call */
221			/* step 5 */
222	✓✓✓✓	149	}
223
224	✗✓	12	if (!BN_GENCB_call(cb, 2, 0))
225			goto err;
226	✗✓	12	if (!BN_GENCB_call(cb, 3, 0))
227			goto err;
228
229			/* step 6 */
230			counter = 0;
231			/* "offset = 2" */
232
233		12	n = (bits - 1) / 160;
234
235		1921	for (;;) {
236	✓✓✗✓	3830	if (counter != 0 && !BN_GENCB_call(cb, 0, counter))
237			goto err;
238
239			/* step 7 */
240		1921	BN_zero(W);
241			/* now 'buf' contains "SEED + offset - 1" */
242	✓✓	23350	for (k = 0; k <= n; k++) {
243			/* obtain "SEED + offset + k" by incrementing: */
244	✓✗	19594	for (i = qsize - 1; i >= 0; i--) {
245		9797	buf[i]++;
246	✓✓	9797	if (buf[i] != 0)
247			break;
248			}
249
250	✗✓	9754	if (!EVP_Digest(buf, qsize, md ,NULL, evpmd,
251			NULL))
252			goto err;
253
254			/* step 8 */
255	✗✓	9754	if (!BN_bin2bn(md, qsize, r0))
256			goto err;
257	✗✓	9754	if (!BN_lshift(r0, r0, (qsize << 3) * k))
258			goto err;
259	✗✓	9754	if (!BN_add(W, W, r0))
260			goto err;
261			}
262
263			/* more of step 8 */
264	✗✓	1921	if (!BN_mask_bits(W, bits - 1))
265			goto err;
266	✗✓	1921	if (!BN_copy(X, W))
267			goto err;
268	✗✓	1921	if (!BN_add(X, X, test))
269			goto err;
270
271			/* step 9 */
272	✗✓	1921	if (!BN_lshift1(r0, q))
273			goto err;
274	✗✓	1921	if (!BN_mod_ct(c, X, r0, ctx))
275			goto err;
276	✗✓	1921	if (!BN_sub(r0, c, BN_value_one()))
277			goto err;
278	✗✓	1921	if (!BN_sub(p, X, r0))
279			goto err;
280
281			/* step 10 */
282	✓✗	1921	if (BN_cmp(p, test) >= 0) {
283			/* step 11 */
284		1921	r = BN_is_prime_fasttest_ex(p, DSS_prime_checks,
285			ctx, 1, cb);
286	✓✓	1921	if (r > 0)
287			goto end; /* found it */
288	✗✓	1909	if (r != 0)
289			goto err;
290			}
291
292			/* step 13 */
293		1909	counter++;
294			/* "offset = offset + n + 1" */
295
296			/* step 14 */
297	✓✗	1909	if (counter >= 4096)
298			break;
299			}
300			}
301			end:
302	✗✓	12	if (!BN_GENCB_call(cb, 2, 1))
303			goto err;
304
305			/* We now need to generate g */
306			/* Set r0=(p-1)/q */
307	✗✓	12	if (!BN_sub(test, p, BN_value_one()))
308			goto err;
309	✗✓	12	if (!BN_div_ct(r0, NULL, test, q, ctx))
310			goto err;
311
312	✗✓	12	if (!BN_set_word(test, h))
313			goto err;
314	✗✓	12	if (!BN_MONT_CTX_set(mont, p, ctx))
315			goto err;
316
317		12	for (;;) {
318			/* g=test^r0%p */
319	✗✓	12	if (!BN_mod_exp_mont_ct(g, test, r0, p, ctx, mont))
320			goto err;
321	✗✓✗✗ ✗✗	12	if (!BN_is_one(g))
322			break;
323			if (!BN_add(test, test, BN_value_one()))
324			goto err;
325			h++;
326			}
327
328	✗✓	12	if (!BN_GENCB_call(cb, 3, 1))
329			goto err;
330
331		12	ok = 1;
332			err:
333	✓✗	12	if (ok) {
334		12	BN_free(ret->p);
335		12	BN_free(ret->q);
336		12	BN_free(ret->g);
337		12	ret->p = BN_dup(p);
338		12	ret->q = BN_dup(q);
339		12	ret->g = BN_dup(g);
340	✓✗✓✗ ✗✓	36	if (ret->p == NULL \|\| ret->q == NULL \|\| ret->g == NULL) {
341			ok = 0;
342			goto err;
343			}
344	✓✓	12	if (counter_ret != NULL)
345		6	*counter_ret = counter;
346	✓✓	12	if (h_ret != NULL)
347		6	*h_ret = h;
348	✗✓	12	if (seed_out != NULL)
349			memcpy(seed_out, seed, qsize);
350			}
351	✓✗	12	if (ctx) {
352		12	BN_CTX_end(ctx);
353		12	BN_CTX_free(ctx);
354		12	}
355		12	BN_MONT_CTX_free(mont);
356		12	return ok;
357		12	}
358			#endif