BN_MOD_EXP_MONT(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

✨ BN_MOD_EXP_MONT ✨

okay bestie, gather round, because we're talking about Montgomery exponentiation from OpenSSL and honestly?? it's giving math girlboss energy 💅

This page lives in section 3ossl of the manual, and it covers three functions: BN_mod_exp_mont, BN_mod_exp_mont_consttime, and BN_mod_exp_mont_consttime_x2. Yes, that last one is a mouthful. We love her anyway. 🎀

🌸 NAME 🌸

BN_mod_exp_mont, BN_mod_exp_mont_consttime, BN_mod_exp_mont_consttime_x2 — Montgomery exponentiation, aka the vibe of raising stuff to powers modulo stuff but make it Montgomery 🦋

✨ SYNOPSIS ✨

like, the whole invite list:

#include <openssl/bn.h>

int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont);

int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                              const BIGNUM *m, BN_CTX *ctx,
                              BN_MONT_CTX *in_mont);

int BN_mod_exp_mont_consttime_x2(BIGNUM *rr1, const BIGNUM *a1,
                                 const BIGNUM *p1, const BIGNUM *m1,
                                 BN_MONT_CTX *in_mont1, BIGNUM *rr2,
                                 const BIGNUM *a2, const BIGNUM *p2,
                                 const BIGNUM *m2, BN_MONT_CTX *in_mont2,
                                 BN_CTX *ctx);

no cap, those signatures are long but they're literally just doing the math for you 🧚

💖 DESCRIPTION 💖

BN_mod_exp_mont 👑

BN_mod_exp_mont() computes a to the p-th power modulo m — that's "rr=a^p % m" — using Montgomery multiplication. periodt.

in_mont is a Montgomery context and can be NULL. And here's the tea ☕: in the case in_mont is NULL, it will be initialized within the function, so you can save time on initialization if you provide it in advance. main character optimization energy fr fr ⭐

BN_mod_exp_mont_consttime 🕵️♀️

BN_mod_exp_mont_consttime() also computes a to the p-th power modulo m — "rr=a^p % m" — using Montgomery multiplication. She's a variant of BN_mod_exp_mont(3) that uses fixed windows and the special precomputation memory layout to limit data-dependency to a minimum to protect secret exponents. 🛡️✨

the way that it's called automatically when BN_mod_exp_mont(3) is called with parameters a, p, m, any of which have BN_FLG_CONSTTIME flag — she just shows up uninvited and slays 💅

BN_mod_exp_mont_consttime_x2 👯♀️

BN_mod_exp_mont_consttime_x2() computes two independent exponentiations — a1 to the p1-th power modulo m1 ("rr1=a1^p1 % m1") and a2 to the p2-th power modulo m2 ("rr2=a2^p2 % m2") — using Montgomery multiplication. two of them. at once. iconic behavior 😭🔥

For some fixed and equal modulus sizes m1 and m2 it uses optimizations that allow to speedup two exponentiations. In all other cases the function reduces to two calls of BN_mod_exp_mont_consttime(3). so like, if the moduli don't match up, she's not doing anything fancy, she's just doing it twice. respect the hustle 🫶

🎀 RETURN VALUES 🎀

For all functions 1 is returned for success, 0 on error. simple. clean. no drama. ✅

The error codes can be obtained by ERR_get_error(3). go check her out if something's giving error energy 💀

🌈 SEE ALSO 🌈

iykyk, go read those too, bestie 📚

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, babe 💜 this was BN_mod_exp_mont(3ossl) from OpenSSL version 3.5.9, dated 2026-09-29. stay modular, stay montgomery, and don't forget to initialize your context in advance if you're in a hurry 🦋✨💖

📦 where this page comes from