crypto/rsa/rsa_eay.c

709     BIGNUM *r1, *m1, *vrfy;
717     vrfy = BN_CTX_get(ctx);
879             if (!BN_mod_exp_mont(vrfy, r0, rsa->e, rsa->n, ctx,
884             if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,
894         if (!BN_sub(vrfy, vrfy, I))
896         if (BN_is_zero(vrfy)) {
901         if (!BN_mod(vrfy, vrfy, rsa->n, ctx))
903         if (BN_is_negative(vrfy))
904             if (!BN_add(vrfy, vrfy, rsa->n))
906         if (!BN_is_zero(vrfy)) {
908              * 'I' and 'vrfy' aren't congruent mod n. Don't leak