1 /** 2 * Core bignum functions 3 * 4 * This interface should only be used by the legacy bignum module (bignum.h) 5 * and the modular bignum modules (bignum_mod.c, bignum_mod_raw.c). All other 6 * modules should use the high-level modular bignum interface (bignum_mod.h) 7 * or the legacy bignum interface (bignum.h). 8 * 9 * This module is about processing non-negative integers with a fixed upper 10 * bound that's of the form 2^n-1 where n is a multiple of #biL. 11 * These can be thought of integers written in base 2^#biL with a fixed 12 * number of digits. Digits in this base are called *limbs*. 13 * Many operations treat these numbers as the principal representation of 14 * a number modulo 2^n or a smaller bound. 15 * 16 * The functions in this module obey the following conventions unless 17 * explicitly indicated otherwise: 18 * 19 * - **Overflow**: some functions indicate overflow from the range 20 * [0, 2^n-1] by returning carry parameters, while others operate 21 * modulo and so cannot overflow. This should be clear from the function 22 * documentation. 23 * - **Bignum parameters**: Bignums are passed as pointers to an array of 24 * limbs. A limb has the type #mbedtls_mpi_uint. Unless otherwise specified: 25 * - Bignum parameters called \p A, \p B, ... are inputs, and are 26 * not modified by the function. 27 * - For operations modulo some number, the modulus is called \p N 28 * and is input-only. 29 * - Bignum parameters called \p X, \p Y are outputs or input-output. 30 * The initial content of output-only parameters is ignored. 31 * - Some functions use different names that reflect traditional 32 * naming of operands of certain operations (e.g. 33 * divisor/dividend/quotient/remainder). 34 * - \p T is a temporary storage area. The initial content of such 35 * parameter is ignored and the final content is unspecified. 36 * - **Bignum sizes**: bignum sizes are always expressed in limbs. 37 * Most functions work on bignums of a given size and take a single 38 * \p limbs parameter that applies to all parameters that are limb arrays. 39 * All bignum sizes must be at least 1 and must be significantly less than 40 * #SIZE_MAX. The behavior if a size is 0 is undefined. The behavior if the 41 * total size of all parameters overflows #SIZE_MAX is undefined. 42 * - **Parameter ordering**: for bignum parameters, outputs come before inputs. 43 * Temporaries come last. 44 * - **Aliasing**: in general, output bignums may be aliased to one or more 45 * inputs. As an exception, parameters that are documented as a modulus value 46 * may not be aliased to an output. Outputs may not be aliased to one another. 47 * Temporaries may not be aliased to any other parameter. 48 * - **Overlap**: apart from aliasing of limb array pointers (where two 49 * arguments are equal pointers), overlap is not supported and may result 50 * in undefined behavior. 51 * - **Error handling**: This is a low-level module. Functions generally do not 52 * try to protect against invalid arguments such as nonsensical sizes or 53 * null pointers. Note that some functions that operate on bignums of 54 * different sizes have constraints about their size, and violating those 55 * constraints may lead to buffer overflows. 56 * - **Modular representatives**: functions that operate modulo \p N expect 57 * all modular inputs to be in the range [0, \p N - 1] and guarantee outputs 58 * in the range [0, \p N - 1]. If an input is out of range, outputs are 59 * fully unspecified, though bignum values out of range should not cause 60 * buffer overflows (beware that this is not extensively tested). 61 */ 62 63 /* 64 * Copyright The Mbed TLS Contributors 65 * SPDX-License-Identifier: Apache-2.0 66 * 67 * Licensed under the Apache License, Version 2.0 (the "License"); you may 68 * not use this file except in compliance with the License. 69 * You may obtain a copy of the License at 70 * 71 * http://www.apache.org/licenses/LICENSE-2.0 72 * 73 * Unless required by applicable law or agreed to in writing, software 74 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 75 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 76 * See the License for the specific language governing permissions and 77 * limitations under the License. 78 */ 79 80 #ifndef MBEDTLS_BIGNUM_CORE_H 81 #define MBEDTLS_BIGNUM_CORE_H 82 83 #include "common.h" 84 85 #if defined(MBEDTLS_BIGNUM_C) 86 #include "mbedtls/bignum.h" 87 #endif 88 89 #define ciL ( sizeof(mbedtls_mpi_uint) ) /** chars in limb */ 90 #define biL ( ciL << 3 ) /** bits in limb */ 91 #define biH ( ciL << 2 ) /** half limb size */ 92 93 /* 94 * Convert between bits/chars and number of limbs 95 * Divide first in order to avoid potential overflows 96 */ 97 #define BITS_TO_LIMBS(i) ( (i) / biL + ( (i) % biL != 0 ) ) 98 #define CHARS_TO_LIMBS(i) ( (i) / ciL + ( (i) % ciL != 0 ) ) 99 /* Get a specific byte, without range checks. */ 100 #define GET_BYTE( X, i ) \ 101 ( ( (X)[(i) / ciL] >> ( ( (i) % ciL ) * 8 ) ) & 0xff ) 102 103 /** Count leading zero bits in a given integer. 104 * 105 * \param a Integer to count leading zero bits. 106 * 107 * \return The number of leading zero bits in \p a. 108 */ 109 size_t mbedtls_mpi_core_clz( mbedtls_mpi_uint a ); 110 111 /** Return the minimum number of bits required to represent the value held 112 * in the MPI. 113 * 114 * \note This function returns 0 if all the limbs of \p A are 0. 115 * 116 * \param[in] A The address of the MPI. 117 * \param A_limbs The number of limbs of \p A. 118 * 119 * \return The number of bits in \p A. 120 */ 121 size_t mbedtls_mpi_core_bitlen( const mbedtls_mpi_uint *A, size_t A_limbs ); 122 123 /** Convert a big-endian byte array aligned to the size of mbedtls_mpi_uint 124 * into the storage form used by mbedtls_mpi. 125 * 126 * \param[in,out] A The address of the MPI. 127 * \param A_limbs The number of limbs of \p A. 128 */ 129 void mbedtls_mpi_core_bigendian_to_host( mbedtls_mpi_uint *A, 130 size_t A_limbs ); 131 132 /** 133 * \brief Perform a safe conditional copy of an MPI which doesn't reveal 134 * whether assignment was done or not. 135 * 136 * \param[out] X The address of the destination MPI. 137 * This must be initialized. Must have enough limbs to 138 * store the full value of \p A. 139 * \param[in] A The address of the source MPI. This must be initialized. 140 * \param limbs The number of limbs of \p A. 141 * \param assign The condition deciding whether to perform the 142 * assignment or not. Must be either 0 or 1: 143 * * \c 1: Perform the assignment `X = A`. 144 * * \c 0: Keep the original value of \p X. 145 * 146 * \note This function avoids leaking any information about whether 147 * the assignment was done or not. 148 * 149 * \warning If \p assign is neither 0 nor 1, the result of this function 150 * is indeterminate, and the resulting value in \p X might be 151 * neither its original value nor the value in \p A. 152 */ 153 void mbedtls_mpi_core_cond_assign( mbedtls_mpi_uint *X, 154 const mbedtls_mpi_uint *A, 155 size_t limbs, 156 unsigned char assign ); 157 158 /** 159 * \brief Perform a safe conditional swap of two MPIs which doesn't reveal 160 * whether the swap was done or not. 161 * 162 * \param[in,out] X The address of the first MPI. 163 * This must be initialized. 164 * \param[in,out] Y The address of the second MPI. 165 * This must be initialized. 166 * \param limbs The number of limbs of \p X and \p Y. 167 * \param swap The condition deciding whether to perform 168 * the swap or not. Must be either 0 or 1: 169 * * \c 1: Swap the values of \p X and \p Y. 170 * * \c 0: Keep the original values of \p X and \p Y. 171 * 172 * \note This function avoids leaking any information about whether 173 * the swap was done or not. 174 * 175 * \warning If \p swap is neither 0 nor 1, the result of this function 176 * is indeterminate, and both \p X and \p Y might end up with 177 * values different to either of the original ones. 178 */ 179 void mbedtls_mpi_core_cond_swap( mbedtls_mpi_uint *X, 180 mbedtls_mpi_uint *Y, 181 size_t limbs, 182 unsigned char swap ); 183 184 /** Import X from unsigned binary data, little-endian. 185 * 186 * The MPI needs to have enough limbs to store the full value (including any 187 * most significant zero bytes in the input). 188 * 189 * \param[out] X The address of the MPI. 190 * \param X_limbs The number of limbs of \p X. 191 * \param[in] input The input buffer to import from. 192 * \param input_length The length bytes of \p input. 193 * 194 * \return \c 0 if successful. 195 * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p X isn't 196 * large enough to hold the value in \p input. 197 */ 198 int mbedtls_mpi_core_read_le( mbedtls_mpi_uint *X, 199 size_t X_limbs, 200 const unsigned char *input, 201 size_t input_length ); 202 203 /** Import X from unsigned binary data, big-endian. 204 * 205 * The MPI needs to have enough limbs to store the full value (including any 206 * most significant zero bytes in the input). 207 * 208 * \param[out] X The address of the MPI. 209 * May only be #NULL if \X_limbs is 0 and \p input_length 210 * is 0. 211 * \param X_limbs The number of limbs of \p X. 212 * \param[in] input The input buffer to import from. 213 * May only be #NULL if \p input_length is 0. 214 * \param input_length The length in bytes of \p input. 215 * 216 * \return \c 0 if successful. 217 * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p X isn't 218 * large enough to hold the value in \p input. 219 */ 220 int mbedtls_mpi_core_read_be( mbedtls_mpi_uint *X, 221 size_t X_limbs, 222 const unsigned char *input, 223 size_t input_length ); 224 225 /** Export A into unsigned binary data, little-endian. 226 * 227 * \note If \p output is shorter than \p A the export is still successful if the 228 * value held in \p A fits in the buffer (that is, if enough of the most 229 * significant bytes of \p A are 0). 230 * 231 * \param[in] A The address of the MPI. 232 * \param A_limbs The number of limbs of \p A. 233 * \param[out] output The output buffer to export to. 234 * \param output_length The length in bytes of \p output. 235 * 236 * \return \c 0 if successful. 237 * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p output isn't 238 * large enough to hold the value of \p A. 239 */ 240 int mbedtls_mpi_core_write_le( const mbedtls_mpi_uint *A, 241 size_t A_limbs, 242 unsigned char *output, 243 size_t output_length ); 244 245 /** Export A into unsigned binary data, big-endian. 246 * 247 * \note If \p output is shorter than \p A the export is still successful if the 248 * value held in \p A fits in the buffer (that is, if enough of the most 249 * significant bytes of \p A are 0). 250 * 251 * \param[in] A The address of the MPI. 252 * \param A_limbs The number of limbs of \p A. 253 * \param[out] output The output buffer to export to. 254 * \param output_length The length in bytes of \p output. 255 * 256 * \return \c 0 if successful. 257 * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p output isn't 258 * large enough to hold the value of \p A. 259 */ 260 int mbedtls_mpi_core_write_be( const mbedtls_mpi_uint *A, 261 size_t A_limbs, 262 unsigned char *output, 263 size_t output_length ); 264 265 /** \brief Shift an MPI right in place by a number of bits. 266 * 267 * Shifting by more bits than there are bit positions 268 * in \p X is valid and results in setting \p X to 0. 269 * 270 * This function's execution time depends on the value 271 * of \p count (and of course \p limbs). 272 * 273 * \param[in,out] X The number to shift. 274 * \param limbs The number of limbs of \p X. This must be at least 1. 275 * \param count The number of bits to shift by. 276 */ 277 void mbedtls_mpi_core_shift_r( mbedtls_mpi_uint *X, size_t limbs, 278 size_t count ); 279 280 /** 281 * \brief Add two fixed-size large unsigned integers, returning the carry. 282 * 283 * Calculates `A + B` where `A` and `B` have the same size. 284 * 285 * This function operates modulo `2^(biL*limbs)` and returns the carry 286 * (1 if there was a wraparound, and 0 otherwise). 287 * 288 * \p X may be aliased to \p A or \p B. 289 * 290 * \param[out] X The result of the addition. 291 * \param[in] A Little-endian presentation of the left operand. 292 * \param[in] B Little-endian presentation of the right operand. 293 * \param limbs Number of limbs of \p X, \p A and \p B. 294 * 295 * \return 1 if `A + B >= 2^(biL*limbs)`, 0 otherwise. 296 */ 297 mbedtls_mpi_uint mbedtls_mpi_core_add( mbedtls_mpi_uint *X, 298 const mbedtls_mpi_uint *A, 299 const mbedtls_mpi_uint *B, 300 size_t limbs ); 301 302 /** 303 * \brief Conditional addition of two fixed-size large unsigned integers, 304 * returning the carry. 305 * 306 * Functionally equivalent to 307 * 308 * ``` 309 * if( cond ) 310 * X += A; 311 * return carry; 312 * ``` 313 * 314 * This function operates modulo `2^(biL*limbs)`. 315 * 316 * \param[in,out] X The pointer to the (little-endian) array 317 * representing the bignum to accumulate onto. 318 * \param[in] A The pointer to the (little-endian) array 319 * representing the bignum to conditionally add 320 * to \p X. This may be aliased to \p X but may not 321 * overlap otherwise. 322 * \param limbs Number of limbs of \p X and \p A. 323 * \param cond Condition bit dictating whether addition should 324 * happen or not. This must be \c 0 or \c 1. 325 * 326 * \warning If \p cond is neither 0 nor 1, the result of this function 327 * is unspecified, and the resulting value in \p X might be 328 * neither its original value nor \p X + \p A. 329 * 330 * \return 1 if `X + cond * A >= 2^(biL*limbs)`, 0 otherwise. 331 */ 332 mbedtls_mpi_uint mbedtls_mpi_core_add_if( mbedtls_mpi_uint *X, 333 const mbedtls_mpi_uint *A, 334 size_t limbs, 335 unsigned cond ); 336 337 /** 338 * \brief Subtract two fixed-size large unsigned integers, returning the borrow. 339 * 340 * Calculate `A - B` where \p A and \p B have the same size. 341 * This function operates modulo `2^(biL*limbs)` and returns the carry 342 * (1 if there was a wraparound, i.e. if `A < B`, and 0 otherwise). 343 * 344 * \p X may be aliased to \p A or \p B, or even both, but may not overlap 345 * either otherwise. 346 * 347 * \param[out] X The result of the subtraction. 348 * \param[in] A Little-endian presentation of left operand. 349 * \param[in] B Little-endian presentation of right operand. 350 * \param limbs Number of limbs of \p X, \p A and \p B. 351 * 352 * \return 1 if `A < B`. 353 * 0 if `A >= B`. 354 */ 355 mbedtls_mpi_uint mbedtls_mpi_core_sub( mbedtls_mpi_uint *X, 356 const mbedtls_mpi_uint *A, 357 const mbedtls_mpi_uint *B, 358 size_t limbs ); 359 360 /** 361 * \brief Perform a fixed-size multiply accumulate operation: X += b * A 362 * 363 * \p X may be aliased to \p A (when \p X_limbs == \p A_limbs), but may not 364 * otherwise overlap. 365 * 366 * This function operates modulo `2^(biL*X_limbs)`. 367 * 368 * \param[in,out] X The pointer to the (little-endian) array 369 * representing the bignum to accumulate onto. 370 * \param X_limbs The number of limbs of \p X. This must be 371 * at least \p A_limbs. 372 * \param[in] A The pointer to the (little-endian) array 373 * representing the bignum to multiply with. 374 * This may be aliased to \p X but may not overlap 375 * otherwise. 376 * \param A_limbs The number of limbs of \p A. 377 * \param b X scalar to multiply with. 378 * 379 * \return The carry at the end of the operation. 380 */ 381 mbedtls_mpi_uint mbedtls_mpi_core_mla( mbedtls_mpi_uint *X, size_t X_limbs, 382 const mbedtls_mpi_uint *A, size_t A_limbs, 383 mbedtls_mpi_uint b ); 384 385 /** 386 * \brief Calculate initialisation value for fast Montgomery modular 387 * multiplication 388 * 389 * \param[in] N Little-endian presentation of the modulus. This must have 390 * at least one limb. 391 * 392 * \return The initialisation value for fast Montgomery modular multiplication 393 */ 394 mbedtls_mpi_uint mbedtls_mpi_core_montmul_init( const mbedtls_mpi_uint *N ); 395 396 /** 397 * \brief Montgomery multiplication: X = A * B * R^-1 mod N (HAC 14.36) 398 * 399 * \p A and \p B must be in canonical form. That is, < \p N. 400 * 401 * \p X may be aliased to \p A or \p N, or even \p B (if \p AN_limbs == 402 * \p B_limbs) but may not overlap any parameters otherwise. 403 * 404 * \p A and \p B may alias each other, if \p AN_limbs == \p B_limbs. They may 405 * not alias \p N (since they must be in canonical form, they cannot == \p N). 406 * 407 * \param[out] X The destination MPI, as a little-endian array of 408 * length \p AN_limbs. 409 * On successful completion, X contains the result of 410 * the multiplication `A * B * R^-1` mod N where 411 * `R = 2^(biL*AN_limbs)`. 412 * \param[in] A Little-endian presentation of first operand. 413 * Must have the same number of limbs as \p N. 414 * \param[in] B Little-endian presentation of second operand. 415 * \param[in] B_limbs The number of limbs in \p B. 416 * Must be <= \p AN_limbs. 417 * \param[in] N Little-endian presentation of the modulus. 418 * This must be odd, and have exactly the same number 419 * of limbs as \p A. 420 * It may alias \p X, but must not alias or otherwise 421 * overlap any of the other parameters. 422 * \param[in] AN_limbs The number of limbs in \p X, \p A and \p N. 423 * \param mm The Montgomery constant for \p N: -N^-1 mod 2^biL. 424 * This can be calculated by `mbedtls_mpi_core_montmul_init()`. 425 * \param[in,out] T Temporary storage of size at least 2*AN_limbs+1 limbs. 426 * Its initial content is unused and 427 * its final content is indeterminate. 428 * It must not alias or otherwise overlap any of the 429 * other parameters. 430 */ 431 void mbedtls_mpi_core_montmul( mbedtls_mpi_uint *X, 432 const mbedtls_mpi_uint *A, 433 const mbedtls_mpi_uint *B, size_t B_limbs, 434 const mbedtls_mpi_uint *N, size_t AN_limbs, 435 mbedtls_mpi_uint mm, mbedtls_mpi_uint *T ); 436 437 /** 438 * \brief Calculate the square of the Montgomery constant. (Needed 439 * for conversion and operations in Montgomery form.) 440 * 441 * \param[out] X A pointer to the result of the calculation of 442 * the square of the Montgomery constant: 443 * 2^{2*n*biL} mod N. 444 * \param[in] N Little-endian presentation of the modulus, which must be odd. 445 * 446 * \return 0 if successful. 447 * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if there is not enough space 448 * to store the value of Montgomery constant squared. 449 * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p N modulus is zero. 450 * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p N modulus is negative. 451 */ 452 int mbedtls_mpi_core_get_mont_r2_unsafe( mbedtls_mpi *X, 453 const mbedtls_mpi *N ); 454 455 #if defined(MBEDTLS_TEST_HOOKS) 456 /** 457 * Copy an MPI from a table without leaking the index. 458 * 459 * \param dest The destination buffer. This must point to a writable 460 * buffer of at least \p limbs limbs. 461 * \param table The address of the table. This must point to a readable 462 * array of \p count elements of \p limbs limbs each. 463 * \param limbs The number of limbs in each table entry. 464 * \param count The number of entries in \p table. 465 * \param index The (secret) table index to look up. This must be in the 466 * range `0 .. count-1`. 467 */ 468 void mbedtls_mpi_core_ct_uint_table_lookup( mbedtls_mpi_uint *dest, 469 const mbedtls_mpi_uint *table, 470 size_t limbs, 471 size_t count, 472 size_t index ); 473 #endif /* MBEDTLS_TEST_HOOKS */ 474 475 /** 476 * \brief Fill an integer with a number of random bytes. 477 * 478 * \param X The destination MPI. 479 * \param X_limbs The number of limbs of \p X. 480 * \param bytes The number of random bytes to generate. 481 * \param f_rng The RNG function to use. This must not be \c NULL. 482 * \param p_rng The RNG parameter to be passed to \p f_rng. This may be 483 * \c NULL if \p f_rng doesn't need a context argument. 484 * 485 * \return \c 0 if successful. 486 * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p X does not have 487 * enough room for \p bytes bytes. 488 * \return A negative error code on RNG failure. 489 * 490 * \note The bytes obtained from the RNG are interpreted 491 * as a big-endian representation of an MPI; this can 492 * be relevant in applications like deterministic ECDSA. 493 */ 494 int mbedtls_mpi_core_fill_random( mbedtls_mpi_uint *X, size_t X_limbs, 495 size_t bytes, 496 int (*f_rng)(void *, unsigned char *, size_t), 497 void *p_rng ); 498 499 /* BEGIN MERGE SLOT 1 */ 500 501 /** 502 * \brief Returns the number of limbs of working memory required for 503 * a call to `mbedtls_mpi_core_exp_mod()`. 504 * 505 * \param AN_limbs The number of limbs in the input `A` and the modulus `N` 506 * (they must be the same size) that will be given to 507 * `mbedtls_mpi_core_exp_mod()`. 508 * \param E_limbs The number of limbs in the exponent `E` that will be given 509 * to `mbedtls_mpi_core_exp_mod()`. 510 * 511 * \return The number of limbs of working memory required by 512 * `mbedtls_mpi_core_exp_mod()`. 513 */ 514 size_t mbedtls_mpi_core_exp_mod_working_limbs( size_t AN_limbs, size_t E_limbs ); 515 516 /** 517 * \brief Perform a modular exponentiation with secret exponent: 518 * X = A^E mod N, where \p A is already in Montgomery form. 519 * 520 * \param[out] X The destination MPI, as a little endian array of length 521 * \p AN_limbs. 522 * \param[in] A The base MPI, as a little endian array of length \p AN_limbs. 523 * Must be in Montgomery form. 524 * \param[in] N The modulus, as a little endian array of length \p AN_limbs. 525 * \param AN_limbs The number of limbs in \p X, \p A, \p N, \p RR. 526 * \param[in] E The exponent, as a little endian array of length \p E_limbs. 527 * \param E_limbs The number of limbs in \p E. 528 * \param[in] RR The precomputed residue of 2^{2*biL} modulo N, as a little 529 * endian array of length \p AN_limbs. 530 * \param[in,out] T Temporary storage of at least the number of limbs returned 531 * by `mbedtls_mpi_core_exp_mod_working_limbs()`. 532 * Its initial content is unused and its final content is 533 * indeterminate. 534 * It must not alias or otherwise overlap any of the other 535 * parameters. 536 * It is up to the caller to zeroize \p T when it is no 537 * longer needed, and before freeing it if it was dynamically 538 * allocated. 539 */ 540 void mbedtls_mpi_core_exp_mod( mbedtls_mpi_uint *X, 541 const mbedtls_mpi_uint *A, 542 const mbedtls_mpi_uint *N, size_t AN_limbs, 543 const mbedtls_mpi_uint *E, size_t E_limbs, 544 const mbedtls_mpi_uint *RR, 545 mbedtls_mpi_uint *T ); 546 547 /* END MERGE SLOT 1 */ 548 549 /* BEGIN MERGE SLOT 2 */ 550 551 /* END MERGE SLOT 2 */ 552 553 /* BEGIN MERGE SLOT 3 */ 554 555 /** 556 * \brief Subtract unsigned integer from known-size large unsigned integers. 557 * Return the borrow. 558 * 559 * \param[out] X The result of the subtraction. 560 * \param[in] A The left operand. 561 * \param b The unsigned scalar to subtract. 562 * \param limbs Number of limbs of \p X and \p A. 563 * 564 * \return 1 if `A < b`. 565 * 0 if `A >= b`. 566 */ 567 mbedtls_mpi_uint mbedtls_mpi_core_sub_int( mbedtls_mpi_uint *X, 568 const mbedtls_mpi_uint *A, 569 mbedtls_mpi_uint b, 570 size_t limbs ); 571 572 /* END MERGE SLOT 3 */ 573 574 /* BEGIN MERGE SLOT 4 */ 575 576 /* END MERGE SLOT 4 */ 577 578 /* BEGIN MERGE SLOT 5 */ 579 580 /* END MERGE SLOT 5 */ 581 582 /* BEGIN MERGE SLOT 6 */ 583 584 /* END MERGE SLOT 6 */ 585 586 /* BEGIN MERGE SLOT 7 */ 587 588 /* END MERGE SLOT 7 */ 589 590 /* BEGIN MERGE SLOT 8 */ 591 592 /* END MERGE SLOT 8 */ 593 594 /* BEGIN MERGE SLOT 9 */ 595 596 /* END MERGE SLOT 9 */ 597 598 /* BEGIN MERGE SLOT 10 */ 599 600 /* END MERGE SLOT 10 */ 601 602 #endif /* MBEDTLS_BIGNUM_CORE_H */ 603