BN_MOD_EXP_MONT(3ossl)

💅 BN_MOD_EXP_MONT(3ossl) — the OpenSSL glow-up

okay so bestie, welcome to the 3ossl girlies club 🎀 this is the manual page for BN_mod_exp_mont, BN_mod_exp_mont_consttime, and BN_mod_exp_mont_consttime_x2, and it's literally all about Montgomery exponentiation. yes that's a whole thing. no cap. 💖

---

✨ NAME ✨

BN_mod_exp_mont, BN_mod_exp_mont_consttime, BN_mod_exp_mont_consttime_x2 — Montgomery exponentiation 🔥

---

🌸 SYNOPSIS 🌸

#include <openssl/bn.h>

int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont);

int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                              const BIGNUM *m, BN_CTX *ctx,
                              BN_MONT_CTX *in_mont);

int BN_mod_exp_mont_consttime_x2(BIGNUM *rr1, const BIGNUM *a1,
                                 const BIGNUM *p1, const BIGNUM *m1,
                                 BN_MONT_CTX *in_mont1, BIGNUM *rr2,
                                 const BIGNUM *a2, const BIGNUM *p2,
                                 const BIGNUM *m2, BN_MONT_CTX *in_mont2,
                                 BN_CTX *ctx);

like, grab <openssl/bn.h> first obviously 🫶

---

💜 DESCRIPTION 💜

🦋 BN_mod_exp_mont()

okay so this one computes a to the p-th power modulo m — that's rr=a^p % m — using Montgomery multiplication. iconic behavior honestly.

in_mont is a Montgomery context and it can be NULL. if in_mont is NULL, it gets initialized inside the function, so lowkey you can save time on initialization if you provide it in advance ✨ (the way that precomputation just pays off).

🧚 BN_mod_exp_mont_consttime()

this one also computes a to the p-th power modulo m (rr=a^p % m) using Montgomery multiplication, but it's a variant of BN_mod_exp_mont(3) 🎀

the vibe difference? it uses fixed windows and that special precomputation memory layout to limit data-dependency to a minimum, so it can protect secret exponents. it's giving bodyguard energy fr fr 💅

and plot twist: it's called automatically when BN_mod_exp_mont(3) is called with parameters a, p, m, any of which have the BN_FLG_CONSTTIME flag. so it just shows up uninvited, like a good bestie 👑

🌈 BN_mod_exp_mont_consttime_x2()

double the expo, double the slay 🔥 this one computes two independent exponentiations:

• a1 to the p1-th power modulo m1 (rr1=a1^p1 % m1)
• a2 to the p2-th power modulo m2 (rr2=a2^p2 % m2)

both using Montgomery multiplication. for some fixed and equal modulus sizes m1 and m2 it uses optimizations that allow it to speedup two exponentiations — like a two-for-one deal, we love to see it 💖

in all other cases the function reduces to two calls of BN_mod_exp_mont_consttime(3). not me being a fancier wrapper when the conditions aren't met 😭 still valid tho.

---

⭐ RETURN VALUES ⭐

for all functions, 1 is returned for success and 0 on error. so like, binary. love that for us.

the error codes can be obtained by ERR_get_error(3) 🙈

---

🎀 SEE ALSO 🎀

• ERR_get_error(3)
• BN_mod_exp_mont(3)

---

👑 COPYRIGHT 👑

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🌸 this was the 3.5.6 era, dated 2026-04-07 — BN_MOD_EXP_MONT(3ossl) signing off 💅✨🦋