BN_MOD_MUL_MONTGOMERY(3ossl)

💅 BN_MOD_MUL_MONTGOMERY — Montgomery multiplication, but make it make sense

okay so bestie, welcome to the 3ossl manual page for BN_MOD_MUL_MONTGOMERY. yes the name is a whole mouthful, no we are not changing it, it's iconic in its own way 🎀

this is the OpenSSL squad's guide to Montgomery multiplication — the math trick that makes modular exponentiation go brrr. buckle up 🦋

---

✨ SYNOPSIS ✨

#include <openssl/bn.h>

BN_MONT_CTX *BN_MONT_CTX_new(void);
void BN_MONT_CTX_free(BN_MONT_CTX *mont);

int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *m, BN_CTX *ctx);
BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from);

int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
                          BN_MONT_CTX *mont, BN_CTX *ctx);

int BN_from_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
                       BN_CTX *ctx);

int BN_to_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
                     BN_CTX *ctx);

look at all those function signatures. so many. we love a full roster 👑

---

🌸 DESCRIPTION 🌸

so these functions implement Montgomery multiplication. the way that they're used automatically when BN_mod_exp(3) gets called with suitable input? lowkey magical. but here's the tea — they're also genuinely useful on their own when you've got several operations to do using the same modulus. reuse the setup, skip the repeat work, periodt.

• BN_MONT_CTX_new() — allocates and initializes a BN_MONT_CTX structure. brand new baby struct, freshly allocated, ready to live its main character era ✨
• BN_MONT_CTX_set() — sets up the mont structure from the modulus m by precomputing its inverse and a value R. this is the prep work, the getting-ready-with-me moment 💅
• BN_MONT_CTX_copy() — copies the BN_MONT_CTX from to to... wait no, from from to to. copy-paste but for structs 🫶
• BN_MONT_CTX_free() — frees the components of the BN_MONT_CTX, and, if it was created by BN_MONT_CTX_new(), also the structure itself. and if mont is NULL? nothing is done. no crash, no drama, it just vibes 💀
• BN_mod_mul_montgomery() — computes Mont(a,b):=a*b*R^-1 and places the result in r. that's the whole thing, that's the function 🍓
• BN_from_montgomery() — performs the Montgomery reduction r = a*R^-1. bringing it back down to earth 🌈
• BN_to_montgomery() — computes Mont(a,R^2), i.e. a*R. ⚠️ note that a must be nonnegative and smaller than the modulus — this is not a suggestion bestie, it's a requirement 🚨

and for all of these functions, ctx is a previously allocated BN_CTX used for temporary variables. don't forget to bring your ctx, it's the emotional support scratchpad 🧚

---

🔥 RETURN VALUES 🔥

• BN_MONT_CTX_new() returns the newly allocated BN_MONT_CTX, and NULL on error. glowed up on success, NULL on the flop 😭
• BN_MONT_CTX_free() has no return value. it gives nothing back and that's fine, it's a giver not a taker 💜
• for the other functions: 1 is returned for success, 0 on error. and if you get a 0? the error codes can be obtained by ERR_get_error(3). go check, the receipts are there 🔍

---

⚠️ WARNINGS ⚠️

The inputs must be reduced modulo m, otherwise the result will be outside the expected range. no cap. this is not a drill. reduce your inputs or perish (mathematically) 💀

---

👀 SEE ALSO 👀

ERR_get_error(3), BN_add(3), BN_CTX_new(3)

(the holy trinity of "go read these next", iykyk)

---

📜 HISTORY 📜

BN_MONT_CTX_init() was removed in OpenSSL 1.1.0. gone but not forgotten, rip to a real one 🙈

---

👑 COPYRIGHT 👑

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie!! this was OpenSSL 3.5.9, dated 2026-09-29, and you just read BN_MOD_MUL_MONTGOMERY(3ossl) 💖 now go reduce your inputs modulo m before you embarrass us both. mwah 🎀✨🦋