Require input to mbedtls_mpi_core_exp_mod() to already be in Montgomery form
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
diff --git a/library/bignum_core.c b/library/bignum_core.c
index 6635351..2ed907d 100644
--- a/library/bignum_core.c
+++ b/library/bignum_core.c
@@ -610,9 +610,9 @@
Wtable[0] = 1;
mbedtls_mpi_core_montmul( Wtable, Wtable, RR, AN_limbs, N, AN_limbs, mm, temp );
- /* W[1] = A * R^2 * R^-1 mod N = A * R mod N */
+ /* W[1] = A (already in Montgomery presentation) */
mbedtls_mpi_uint *W1 = Wtable + AN_limbs;
- mbedtls_mpi_core_montmul( W1, A, RR, AN_limbs, N, AN_limbs, mm, temp );
+ memcpy( W1, A, AN_limbs * ciL );
/* W[i+1] = W[i] * W[1], i >= 2 */
mbedtls_mpi_uint *Wprev = W1;
@@ -626,6 +626,8 @@
/* Exponentiation: X := A^E mod N.
*
+ * A must already be in Montgomery form.
+ *
* As in other bignum functions, assume that AN_limbs and E_limbs are nonzero.
*
* RR must contain 2^{2*biL} mod N.
@@ -730,10 +732,6 @@
}
while( ! ( E_bit_index == 0 && E_limb_index == 0 ) );
- /* Convert X back to normal presentation */
- const mbedtls_mpi_uint one = 1;
- mbedtls_mpi_core_montmul( X, X, &one, 1, N, AN_limbs, mm, temp );
-
mbedtls_platform_zeroize( mempool, total_limbs * sizeof(mbedtls_mpi_uint) );
mbedtls_free( mempool );
return( 0 );