BN_MOD_EXP_MONT(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 BN_MOD_EXP_MONT — Montgomery Exponentiation (aka the 3ossl manual, bestie!) ✨

Okay so welcome to the 3ossl manual page for the Montgomery exponentiation girlies 🌸. The stars of the show are BN_mod_exp_mont, BN_mod_exp_mont_consttime, and BN_mod_exp_mont_consttime_x2 — say that three times fast, I dare you 😭.

🌈 SYNOPSIS

#include <openssl/bn.h>

int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont);

int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                              const BIGNUM *m, BN_CTX *ctx,
                              BN_MONT_CTX *in_mont);

int BN_mod_exp_mont_consttime_x2(BIGNUM *rr1, const BIGNUM *a1,
                                 const BIGNUM *p1, const BIGNUM *m1,
                                 BN_MONT_CTX *in_mont1, BIGNUM *rr2,
                                 const BIGNUM *a2, const BIGNUM *p2,
                                 const BIGNUM *m2, BN_MONT_CTX *in_mont2,
                                 BN_CTX *ctx);

Like, look at those signatures. They're giving main character energy 👑 and honestly? Slay.

✨ DESCRIPTION ✨

💖 BN_mod_exp_mont()

This one computes a to the p-th power modulo m, so rr=a^p % m, using Montgomery multiplication 🎀.

The in_mont argument is a Montgomery context, and it can be NULL. If in_mont is NULL, it gets initialized inside the function — so if you pass it in advance, you can save yourself some time on initialization. Lowkey a free glow-up for your performance ✨.

🦋 BN_mod_exp_mont_consttime()

Also computes a to the p-th power modulo m (rr=a^p % m) using Montgomery multiplication — same vibe, different implementation 💅.

It's a variant of BN_mod_exp_mont(3) that uses fixed windows and the special precomputation memory layout to limit data-dependency to a minimum, which protects secret exponents 🔒. Very "don't look at my secrets" of it.

Fun fact: it's called automatically whenever BN_mod_exp_mont(3) is called with parameters a, p, m, any of which have the BN_FLG_CONSTTIME flag set. So it kind of just appears when you need it, iconic behavior fr fr 👑

🌸 BN_mod_exp_mont_consttime_x2()

This one does two independent exponentiations in one go, bestie:

  • a1 to the p1-th power modulo m1 (rr1=a1^p1 % m1)
  • a2 to the p2-th power modulo m2 (rr2=a2^p2 % m2)

Both using Montgomery multiplication 💜.

For some fixed and equal modulus sizes m1 and m2, it uses optimizations that let it speed up two exponentiations. Like a two-for-one deal, we love to see it 🍓.

In all other cases, the function just reduces to two calls of BN_mod_exp_consttime(3) — whoops, that's BN_mod_exp_mont_consttime(3), keep up 💀 — so no cap, it still works, just without the extra speedup.

🫶 RETURN VALUES

For all the functions: 1 is returned for success, 0 on error 🎯.

Need the tea on what went wrong? The error codes can be obtained by ERR_get_error(3) 🔍.

⭐ SEE ALSO

Go read those, iykyk 📚✨

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

⚠️ Real talk: that license bit is legally important, so don't skip it just because it's at the bottom. Respect the paperwork, bestie 🫡

And that's the whole page, mwah 💋 — this cutie was brought to you by version 3.5.0, dated 2026-09-25, and it's the 3ossl manual. Byeee 🦋✨

📦 where this page comes from