diff -up openssl-1.0.2k/crypto/bn/bn_blind.c.9-lives openssl-1.0.2k/crypto/bn/bn_blind.c

--- openssl-1.0.2k/crypto/bn/bn_blind.c.9-lives	2017-01-26 14:22:03.000000000 +0100

+++ openssl-1.0.2k/crypto/bn/bn_blind.c	2019-04-05 10:50:56.136104388 +0200

@@ -206,10 +206,15 @@ int BN_BLINDING_update(BN_BLINDING *b, B

         if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))

             goto err;

     } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {

-        if (!BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))

-            goto err;

-        if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx))

-            goto err;

+        if (b->m_ctx != NULL) {

+            if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx)

+                || !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx))

+                goto err;

+        } else {

+            if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)

+                || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))

+                goto err;

+        }

     }

     ret = 1;

@@ -241,13 +246,13 @@ int BN_BLINDING_convert_ex(BIGNUM *n, BI

     else if (!BN_BLINDING_update(b, ctx))

         return (0);

-    if (r != NULL) {

-        if (!BN_copy(r, b->Ai))

-            ret = 0;

-    }

+    if (r != NULL && (BN_copy(r, b->Ai) == NULL))

+        return 0;

-    if (!BN_mod_mul(n, n, b->A, b->mod, ctx))

-        ret = 0;

+    if (b->m_ctx != NULL)

+        ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);

+    else

+        ret = BN_mod_mul(n, n, b->A, b->mod, ctx);

     return ret;

 }

@@ -264,14 +269,29 @@ int BN_BLINDING_invert_ex(BIGNUM *n, con

     bn_check_top(n);

-    if (r != NULL)

-        ret = BN_mod_mul(n, n, r, b->mod, ctx);

-    else {

-        if (b->Ai == NULL) {

-            BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);

-            return (0);

+    if (r == NULL && (r = b->Ai) == NULL) {

+        BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);

+        return 0;

+    }

+

+    if (b->m_ctx != NULL) {

+        /* ensure that BN_mod_mul_montgomery takes pre-defined path */

+        if (n->dmax >= r->top) {

+            size_t i, rtop = r->top, ntop = n->top;

+            BN_ULONG mask;

+

+            for (i = 0; i < rtop; i++) {

+                mask = (BN_ULONG)0 - ((i - ntop) >> (8 * sizeof(i) - 1));

+                n->d[i] &= mask;

+            }

+            mask = (BN_ULONG)0 - ((rtop - ntop) >> (8 * sizeof(ntop) - 1));

+            /* always true, if (rtop >= ntop) n->top = r->top; */

+            n->top = (int)(rtop & ~mask) | (ntop & mask);

+            n->flags |= (BN_FLG_FIXED_TOP & ~mask);

         }

-        ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);

+        ret = BN_mod_mul_montgomery(n, n, r, b->m_ctx, ctx);

+    } else {

+        ret = BN_mod_mul(n, n, r, b->mod, ctx);

     }

     bn_check_top(n);

@@ -366,14 +386,19 @@ BN_BLINDING *BN_BLINDING_create_param(BN

     } while (1);

     if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) {

-        if (!ret->bn_mod_exp

-            (ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))

+        if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))

             goto err;

     } else {

         if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx))

             goto err;

     }

+    if (ret->m_ctx != NULL) {

+        if (!bn_to_mont_fixed_top(ret->Ai, ret->Ai, ret->m_ctx, ctx)

+            || !bn_to_mont_fixed_top(ret->A, ret->A, ret->m_ctx, ctx))

+            goto err;

+    }

+

     return ret;

  err:

     if (b == NULL && ret != NULL) {

diff -up openssl-1.0.2k/crypto/bn/bn_lib.c.9-lives openssl-1.0.2k/crypto/bn/bn_lib.c

--- openssl-1.0.2k/crypto/bn/bn_lib.c.9-lives	2019-04-05 10:50:56.128104529 +0200

+++ openssl-1.0.2k/crypto/bn/bn_lib.c	2019-04-05 10:50:56.136104388 +0200

@@ -144,74 +144,47 @@ const BIGNUM *BN_value_one(void)

 int BN_num_bits_word(BN_ULONG l)

 {

-    static const unsigned char bits[256] = {

-        0, 1, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 4, 4,

-        5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5,

-        6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,

-        6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,

-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,

-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,

-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,

-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,

-    };

-

-#if defined(SIXTY_FOUR_BIT_LONG)

-    if (l & 0xffffffff00000000L) {

-        if (l & 0xffff000000000000L) {

-            if (l & 0xff00000000000000L) {

-                return (bits[(int)(l >> 56)] + 56);

-            } else

-                return (bits[(int)(l >> 48)] + 48);

-        } else {

-            if (l & 0x0000ff0000000000L) {

-                return (bits[(int)(l >> 40)] + 40);

-            } else

-                return (bits[(int)(l >> 32)] + 32);

-        }

-    } else

-#else

-# ifdef SIXTY_FOUR_BIT

-    if (l & 0xffffffff00000000LL) {

-        if (l & 0xffff000000000000LL) {

-            if (l & 0xff00000000000000LL) {

-                return (bits[(int)(l >> 56)] + 56);

-            } else

-                return (bits[(int)(l >> 48)] + 48);

-        } else {

-            if (l & 0x0000ff0000000000LL) {

-                return (bits[(int)(l >> 40)] + 40);

-            } else

-                return (bits[(int)(l >> 32)] + 32);

-        }

-    } else

-# endif

-#endif

-    {

-#if defined(THIRTY_TWO_BIT) || defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)

-        if (l & 0xffff0000L) {

-            if (l & 0xff000000L)

-                return (bits[(int)(l >> 24L)] + 24);

-            else

-                return (bits[(int)(l >> 16L)] + 16);

-        } else

-#endif

-        {

-#if defined(THIRTY_TWO_BIT) || defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)

-            if (l & 0xff00L)

-                return (bits[(int)(l >> 8)] + 8);

-            else

+    BN_ULONG x, mask;

+    int bits = (l != 0);

+

+#if BN_BITS2 > 32

+    x = l >> 32;

+    mask = (0 - x) & BN_MASK2;

+    mask = (0 - (mask >> (BN_BITS2 - 1)));

+    bits += 32 & mask;

+    l ^= (x ^ l) & mask;

 #endif

-                return (bits[(int)(l)]);

-        }

-    }

+

+    x = l >> 16;

+    mask = (0 - x) & BN_MASK2;

+    mask = (0 - (mask >> (BN_BITS2 - 1)));

+    bits += 16 & mask;

+    l ^= (x ^ l) & mask;

+

+    x = l >> 8;

+    mask = (0 - x) & BN_MASK2;

+    mask = (0 - (mask >> (BN_BITS2 - 1)));

+    bits += 8 & mask;

+    l ^= (x ^ l) & mask;

+

+    x = l >> 4;

+    mask = (0 - x) & BN_MASK2;

+    mask = (0 - (mask >> (BN_BITS2 - 1)));

+    bits += 4 & mask;

+    l ^= (x ^ l) & mask;

+

+    x = l >> 2;

+    mask = (0 - x) & BN_MASK2;

+    mask = (0 - (mask >> (BN_BITS2 - 1)));

+    bits += 2 & mask;

+    l ^= (x ^ l) & mask;

+

+    x = l >> 1;

+    mask = (0 - x) & BN_MASK2;

+    mask = (0 - (mask >> (BN_BITS2 - 1)));

+    bits += 1 & mask;

+

+    return bits;

 }

 int BN_num_bits(const BIGNUM *a)

@@ -519,12 +492,18 @@ BIGNUM *BN_copy(BIGNUM *a, const BIGNUM

     memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);

 #endif

-    a->top = b->top;

     a->neg = b->neg;

+    a->top = b->top;

+    a->flags |= b->flags & BN_FLG_FIXED_TOP;

     bn_check_top(a);

     return (a);

 }

+#define FLAGS_DATA(flags) ((flags) & (BN_FLG_STATIC_DATA \

+                                    | BN_FLG_CONSTTIME   \

+                                    | BN_FLG_FIXED_TOP))

+#define FLAGS_STRUCT(flags) ((flags) & (BN_FLG_MALLOCED))

+

 void BN_swap(BIGNUM *a, BIGNUM *b)

 {

     int flags_old_a, flags_old_b;

@@ -552,10 +531,8 @@ void BN_swap(BIGNUM *a, BIGNUM *b)

     b->dmax = tmp_dmax;

     b->neg = tmp_neg;

-    a->flags =

-        (flags_old_a & BN_FLG_MALLOCED) | (flags_old_b & BN_FLG_STATIC_DATA);

-    b->flags =

-        (flags_old_b & BN_FLG_MALLOCED) | (flags_old_a & BN_FLG_STATIC_DATA);

+    a->flags = FLAGS_STRUCT(flags_old_a) | FLAGS_DATA(flags_old_b);

+    b->flags = FLAGS_STRUCT(flags_old_b) | FLAGS_DATA(flags_old_a);

     bn_check_top(a);

     bn_check_top(b);

 }

@@ -637,6 +614,55 @@ BIGNUM *BN_bin2bn(const unsigned char *s

 }

 /* ignore negative */

+static int bn2binpad(const BIGNUM *a, unsigned char *to, int tolen)

+{

+    int n;

+    size_t i, lasti, j, atop, mask;

+    BN_ULONG l;

+

+    /*

+     * In case |a| is fixed-top, BN_num_bytes can return bogus length,

+     * but it's assumed that fixed-top inputs ought to be "nominated"

+     * even for padded output, so it works out...

+     */

+    n = BN_num_bytes(a);

+    if (tolen == -1) {

+        tolen = n;

+    } else if (tolen < n) {     /* uncommon/unlike case */

+        BIGNUM temp = *a;

+

+        bn_correct_top(&temp);

+        n = BN_num_bytes(&temp);

+        if (tolen < n)

+            return -1;

+    }

+

+    /* Swipe through whole available data and don't give away padded zero. */

+    atop = a->dmax * BN_BYTES;

+    if (atop == 0) {

+        OPENSSL_cleanse(to, tolen);

+        return tolen;

+    }

+

+    lasti = atop - 1;

+    atop = a->top * BN_BYTES;

+    for (i = 0, j = 0, to += tolen; j < (size_t)tolen; j++) {

+        l = a->d[i / BN_BYTES];

+        mask = 0 - ((j - atop) >> (8 * sizeof(i) - 1));

+        *--to = (unsigned char)(l >> (8 * (i % BN_BYTES)) & mask);

+        i += (i - lasti) >> (8 * sizeof(i) - 1); /* stay on last limb */

+    }

+

+    return tolen;

+}

+

+int bn_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen)

+{

+    if (tolen < 0)

+        return -1;

+    return bn2binpad(a, to, tolen);

+}

+

 int BN_bn2bin(const BIGNUM *a, unsigned char *to)

 {

     int n, i;

@@ -810,6 +836,9 @@ int bn_cmp_words(const BN_ULONG *a, cons

     int i;

     BN_ULONG aa, bb;

+    if (n == 0)

+        return 0;

+

     aa = a[n - 1];

     bb = b[n - 1];

     if (aa != bb)

diff -up openssl-1.0.2k/crypto/bn/bn_mod.c.9-lives openssl-1.0.2k/crypto/bn/bn_mod.c

--- openssl-1.0.2k/crypto/bn/bn_mod.c.9-lives	2019-04-05 10:50:56.125104581 +0200

+++ openssl-1.0.2k/crypto/bn/bn_mod.c	2019-04-05 10:50:56.136104388 +0200

@@ -197,6 +197,7 @@ int bn_mod_add_fixed_top(BIGNUM *r, cons

         ((volatile BN_ULONG *)tp)[i] = 0;

     }

     r->top = mtop;

+    r->flags |= BN_FLG_FIXED_TOP;

     r->neg = 0;

     if (tp != storage)

@@ -225,6 +226,70 @@ int BN_mod_sub(BIGNUM *r, const BIGNUM *

 }

 /*

+ * BN_mod_sub variant that may be used if both a and b are non-negative,

+ * a is less than m, while b is of same bit width as m. It's implemented

+ * as subtraction followed by two conditional additions.

+ *

+ * 0 <= a < m

+ * 0 <= b < 2^w < 2*m

+ *

+ * after subtraction

+ *

+ * -2*m < r = a - b < m

+ *

+ * Thus it takes up to two conditional additions to make |r| positive.

+ */

+int bn_mod_sub_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

+                         const BIGNUM *m)

+{

+    size_t i, ai, bi, mtop = m->top;

+    BN_ULONG borrow, carry, ta, tb, mask, *rp;

+    const BN_ULONG *ap, *bp;

+

+    if (bn_wexpand(r, m->top) == NULL)

+        return 0;

+

+    rp = r->d;

+    ap = a->d != NULL ? a->d : rp;

+    bp = b->d != NULL ? b->d : rp;

+

+    for (i = 0, ai = 0, bi = 0, borrow = 0; i < mtop;) {

+        mask = (BN_ULONG)0 - ((i - a->top) >> (8 * sizeof(i) - 1));

+        ta = ap[ai] & mask;

+

+        mask = (BN_ULONG)0 - ((i - b->top) >> (8 * sizeof(i) - 1));

+        tb = bp[bi] & mask;

+        rp[i] = ta - tb - borrow;

+        if (ta != tb)

+            borrow = (ta < tb);

+

+        i++;

+        ai += (i - a->dmax) >> (8 * sizeof(i) - 1);

+        bi += (i - b->dmax) >> (8 * sizeof(i) - 1);

+    }

+    ap = m->d;

+    for (i = 0, mask = 0 - borrow, carry = 0; i < mtop; i++) {

+        ta = ((ap[i] & mask) + carry) & BN_MASK2;

+        carry = (ta < carry);

+        rp[i] = (rp[i] + ta) & BN_MASK2;

+        carry += (rp[i] < ta);

+    }

+    borrow -= carry;

+    for (i = 0, mask = 0 - borrow, carry = 0; i < mtop; i++) {

+        ta = ((ap[i] & mask) + carry) & BN_MASK2;

+        carry = (ta < carry);

+        rp[i] = (rp[i] + ta) & BN_MASK2;

+        carry += (rp[i] < ta);

+    }

+

+    r->top = mtop;

+    r->flags |= BN_FLG_FIXED_TOP;

+    r->neg = 0;

+

+    return 1;

+}

+

+/*

  * BN_mod_sub variant that may be used if both a and b are non-negative and

  * less than m

  */

diff -up openssl-1.0.2k/crypto/bn/bn_mont.c.9-lives openssl-1.0.2k/crypto/bn/bn_mont.c

--- openssl-1.0.2k/crypto/bn/bn_mont.c.9-lives	2019-04-05 10:50:56.125104581 +0200

+++ openssl-1.0.2k/crypto/bn/bn_mont.c	2019-04-05 10:50:56.137104370 +0200

@@ -164,10 +164,10 @@ int bn_mul_mont_fixed_top(BIGNUM *r, con

     bn_check_top(tmp);

     if (a == b) {

-        if (!BN_sqr(tmp, a, ctx))

+        if (!bn_sqr_fixed_top(tmp, a, ctx))

             goto err;

     } else {

-        if (!BN_mul(tmp, a, b, ctx))

+        if (!bn_mul_fixed_top(tmp, a, b, ctx))

             goto err;

     }

     /* reduce from aRR to aR */

@@ -190,6 +190,7 @@ static int bn_from_montgomery_word(BIGNU

     BIGNUM *n;

     BN_ULONG *ap, *np, *rp, n0, v, carry;

     int nl, max, i;

+    unsigned int rtop;

     n = &(mont->N);

     nl = n->top;

@@ -207,12 +208,10 @@ static int bn_from_montgomery_word(BIGNU

     rp = r->d;

     /* clear the top words of T */

-# if 1

-    for (i = r->top; i < max; i++) /* memset? XXX */

-        rp[i] = 0;

-# else

-    memset(&(rp[r->top]), 0, (max - r->top) * sizeof(BN_ULONG));

-# endif

+    for (rtop = r->top, i = 0; i < max; i++) {

+        v = (BN_ULONG)0 - ((i - rtop) >> (8 * sizeof(rtop) - 1));

+        rp[i] &= v;

+    }

     r->top = max;

     r->flags |= BN_FLG_FIXED_TOP;

@@ -263,6 +262,18 @@ static int bn_from_montgomery_word(BIGNU

 int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,

                        BN_CTX *ctx)

 {

+    int retn;

+

+    retn = bn_from_mont_fixed_top(ret, a, mont, ctx);

+    bn_correct_top(ret);

+    bn_check_top(ret);

+

+    return retn;

+}

+

+int bn_from_mont_fixed_top(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,

+                           BN_CTX *ctx)

+{

     int retn = 0;

 #ifdef MONT_WORD

     BIGNUM *t;

@@ -270,8 +281,6 @@ int BN_from_montgomery(BIGNUM *ret, cons

     BN_CTX_start(ctx);

     if ((t = BN_CTX_get(ctx)) && BN_copy(t, a)) {

         retn = bn_from_montgomery_word(ret, t, mont);

-        bn_correct_top(ret);

-        bn_check_top(ret);

     }

     BN_CTX_end(ctx);

 #else                           /* !MONT_WORD */

diff -up openssl-1.0.2k/crypto/bn/bn_mul.c.9-lives openssl-1.0.2k/crypto/bn/bn_mul.c

--- openssl-1.0.2k/crypto/bn/bn_mul.c.9-lives	2017-01-26 14:22:03.000000000 +0100

+++ openssl-1.0.2k/crypto/bn/bn_mul.c	2019-04-05 10:50:56.137104370 +0200

@@ -936,6 +936,16 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *

 int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)

 {

+    int ret = bn_mul_fixed_top(r, a, b, ctx);

+

+    bn_correct_top(r);

+    bn_check_top(r);

+

+    return ret;

+}

+

+int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)

+{

     int ret = 0;

     int top, al, bl;

     BIGNUM *rr;

@@ -1032,46 +1042,6 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, c

             rr->top = top;

             goto end;

         }

-# if 0

-        if (i == 1 && !BN_get_flags(b, BN_FLG_STATIC_DATA)) {

-            BIGNUM *tmp_bn = (BIGNUM *)b;

-            if (bn_wexpand(tmp_bn, al) == NULL)

-                goto err;

-            tmp_bn->d[bl] = 0;

-            bl++;

-            i--;

-        } else if (i == -1 && !BN_get_flags(a, BN_FLG_STATIC_DATA)) {

-            BIGNUM *tmp_bn = (BIGNUM *)a;

-            if (bn_wexpand(tmp_bn, bl) == NULL)

-                goto err;

-            tmp_bn->d[al] = 0;

-            al++;

-            i++;

-        }

-        if (i == 0) {

-            /* symmetric and > 4 */

-            /* 16 or larger */

-            j = BN_num_bits_word((BN_ULONG)al);

-            j = 1 << (j - 1);

-            k = j + j;

-            t = BN_CTX_get(ctx);

-            if (al == j) {      /* exact multiple */

-                if (bn_wexpand(t, k * 2) == NULL)

-                    goto err;

-                if (bn_wexpand(rr, k * 2) == NULL)

-                    goto err;

-                bn_mul_recursive(rr->d, a->d, b->d, al, t->d);

-            } else {

-                if (bn_wexpand(t, k * 4) == NULL)

-                    goto err;

-                if (bn_wexpand(rr, k * 4) == NULL)

-                    goto err;

-                bn_mul_part_recursive(rr->d, a->d, b->d, al - j, j, t->d);

-            }

-            rr->top = top;

-            goto end;

-        }

-# endif

     }

 #endif                          /* BN_RECURSION */

     if (bn_wexpand(rr, top) == NULL)

@@ -1082,7 +1052,7 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, c

 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)

  end:

 #endif

-    bn_correct_top(rr);

+    rr->flags |= BN_FLG_FIXED_TOP;

     if (r != rr && BN_copy(r, rr) == NULL)

         goto err;

diff -up openssl-1.0.2k/crypto/bn/bn_sqr.c.9-lives openssl-1.0.2k/crypto/bn/bn_sqr.c

--- openssl-1.0.2k/crypto/bn/bn_sqr.c.9-lives	2019-04-05 10:50:56.125104581 +0200

+++ openssl-1.0.2k/crypto/bn/bn_sqr.c	2019-04-05 10:50:56.137104370 +0200

@@ -66,6 +66,16 @@

  */

 int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)

 {

+    int ret = bn_sqr_fixed_top(r, a, ctx);

+

+    bn_correct_top(r);

+    bn_check_top(r);

+

+    return ret;

+}

+

+int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)

+{

     int max, al;

     int ret = 0;

     BIGNUM *tmp, *rr;

@@ -136,7 +146,7 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, B

     rr->neg = 0;

     rr->top = max;

-    bn_correct_top(rr);

+    rr->flags |= BN_FLG_FIXED_TOP;

     if (r != rr && BN_copy(r, rr) == NULL)

         goto err;

diff -up openssl-1.0.2k/crypto/bn_int.h.9-lives openssl-1.0.2k/crypto/bn_int.h

--- openssl-1.0.2k/crypto/bn_int.h.9-lives	2019-04-05 10:50:56.125104581 +0200

+++ openssl-1.0.2k/crypto/bn_int.h	2019-04-05 10:50:56.137104370 +0200

@@ -7,7 +7,15 @@

  */

 int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

                           BN_MONT_CTX *mont, BN_CTX *ctx);

+int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,

+                           BN_CTX *ctx);

 int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,

                          BN_CTX *ctx);

 int bn_mod_add_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

                          const BIGNUM *m);

+int bn_mod_sub_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

+                         const BIGNUM *m);

+int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);

+int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx);

+

+int bn_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen);

diff -up openssl-1.0.2k/crypto/constant_time_locl.h.9-lives openssl-1.0.2k/crypto/constant_time_locl.h

--- openssl-1.0.2k/crypto/constant_time_locl.h.9-lives	2019-04-05 10:50:55.545114779 +0200

+++ openssl-1.0.2k/crypto/constant_time_locl.h	2019-04-05 10:50:56.137104370 +0200

@@ -204,6 +204,12 @@ static inline int constant_time_select_i

     return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b)));

 }

+/*

+ * Expected usage pattern is to unconditionally set error and then

+ * wipe it if there was no actual error. |clear| is 1 or 0.

+ */

+void err_clear_last_constant_time(int clear);

+

 #ifdef __cplusplus

 }

 #endif

diff -up openssl-1.0.2k/crypto/err/err.c.9-lives openssl-1.0.2k/crypto/err/err.c

--- openssl-1.0.2k/crypto/err/err.c.9-lives	2017-01-26 14:22:03.000000000 +0100

+++ openssl-1.0.2k/crypto/err/err.c	2019-04-05 10:50:56.138104353 +0200

@@ -118,6 +118,7 @@

 #include <openssl/buffer.h>

 #include <openssl/bio.h>

 #include <openssl/err.h>

+#include "constant_time_locl.h"

 DECLARE_LHASH_OF(ERR_STRING_DATA);

 DECLARE_LHASH_OF(ERR_STATE);

@@ -819,8 +820,24 @@ static unsigned long get_error_values(in

         return ERR_R_INTERNAL_ERROR;

     }

+    while (es->bottom != es->top) {

+        if (es->err_flags[es->top] & ERR_FLAG_CLEAR) {

+            err_clear(es, es->top);

+            es->top = es->top > 0 ? es->top - 1 : ERR_NUM_ERRORS - 1;

+            continue;

+        }

+        i = (es->bottom + 1) % ERR_NUM_ERRORS;

+        if (es->err_flags[i] & ERR_FLAG_CLEAR) {

+            es->bottom = i;

+            err_clear(es, es->bottom);

+            continue;

+        }

+        break;

+    }

+

     if (es->bottom == es->top)

         return 0;

+

     if (top)

         i = es->top;            /* last error */

     else

@@ -1146,3 +1163,23 @@ int ERR_pop_to_mark(void)

     es->err_flags[es->top] &= ~ERR_FLAG_MARK;

     return 1;

 }

+

+void err_clear_last_constant_time(int clear)

+{

+    ERR_STATE *es;

+    int top;

+

+    es = ERR_get_state();

+    if (es == NULL)

+        return;

+

+    top = es->top;

+

+    /*

+     * Flag error as cleared but remove it elsewhere to avoid two errors

+     * accessing the same error stack location, revealing timing information.

+     */

+    clear = constant_time_select_int(constant_time_eq_int(clear, 0),

+                                     0, ERR_FLAG_CLEAR);

+    es->err_flags[top] |= clear;

+}

diff -up openssl-1.0.2k/crypto/err/err.h.9-lives openssl-1.0.2k/crypto/err/err.h

--- openssl-1.0.2k/crypto/err/err.h.9-lives	2019-04-05 10:50:55.450116449 +0200

+++ openssl-1.0.2k/crypto/err/err.h	2019-04-05 11:14:57.689757981 +0200

@@ -143,6 +143,7 @@ extern "C" {

 # define ERR_TXT_STRING          0x02

 # define ERR_FLAG_MARK           0x01

+# define ERR_FLAG_CLEAR          0x02

 # define ERR_NUM_ERRORS  16

 typedef struct err_state_st {

diff -up openssl-1.0.2k/crypto/rsa/rsa_eay.c.9-lives openssl-1.0.2k/crypto/rsa/rsa_eay.c

--- openssl-1.0.2k/crypto/rsa/rsa_eay.c.9-lives	2019-04-05 10:50:55.998106814 +0200

+++ openssl-1.0.2k/crypto/rsa/rsa_eay.c	2019-04-05 10:50:56.138104353 +0200

@@ -118,6 +118,8 @@

 #ifdef OPENSSL_FIPS

 # include <openssl/fips.h>

 #endif

+#include "bn_int.h"

+#include "constant_time_locl.h"

 #ifndef RSA_NULL

@@ -160,7 +162,7 @@ static int RSA_eay_public_encrypt(int fl

                                   unsigned char *to, RSA *rsa, int padding)

 {

     BIGNUM *f, *ret;

-    int i, j, k, num = 0, r = -1;

+    int i, num = 0, r = -1;

     unsigned char *buf = NULL;

     BN_CTX *ctx = NULL;

@@ -252,15 +254,10 @@ static int RSA_eay_public_encrypt(int fl

         goto err;

     /*

-     * put in leading 0 bytes if the number is less than the length of the

-     * modulus

+     * BN_bn2binpad puts in leading 0 bytes if the number is less than

+     * the length of the modulus.

      */

-    j = BN_num_bytes(ret);

-    i = BN_bn2bin(ret, &(to[num - j]));

-    for (k = 0; k < (num - i); k++)

-        to[k] = 0;

-

-    r = num;

+    r = bn_bn2binpad(ret, to, num);

  err: