One more reciprocal thing hid in here (yay for consistent naming)

Remove stale references to BN reciprocal stuff

Correctly detect b < a in BN_usub().

BN_usub() requires that a >= b and should return an error in the case that
b < a. This is currently only detected by checking the number of words in
a versus b -

Correctly detect b < a in BN_usub().

BN_usub() requires that a >= b and should return an error in the case that
b < a. This is currently only detected by checking the number of words in
a versus b - if they have the same number of words, the top word is not
checked and b < a, which then succeeds and produces an incorrect result.

Fix this by checking for the case where a and b have an equal number of
words, yet there is a borrow returned from bn_sub_words().

ok miod@ tb@

show more ...

Mark BN_mod_exp2_mont() as intentionally undocumented.
It appears to be intended for internal use by DSA_do_verify(3) and using
codesearch.debian.net, i found nothing outside OpenSSL/LibreSSL using i

Mark BN_mod_exp2_mont() as intentionally undocumented.
It appears to be intended for internal use by DSA_do_verify(3) and using
codesearch.debian.net, i found nothing outside OpenSSL/LibreSSL using it.

In April 2018, jsing@ questioned whether the five related functions
BN_mod_exp_mont() and friends should even be exposed by <openssl/bn.h>,
so we decided to not document them. Now tb@ agrees that there is no
reason to document BN_mod_exp2_mont() as long as we don't want to
document BN_mod_exp_mont().

show more ...

document BN_mod_add_quick(3), BN_mod_sub_quick(3), BN_mod_lshift(3),
BN_mod_lshift_quick(3), BN_mod_lshift1(3), and BN_mod_lshift1_quick(3)

document BN_uadd(3) and BN_usub(3)

Add missing const qualifiers in a number of BN_* manuals.

ok schwarze

In view of the recent BN_FLG_CONSTTIME vulnerabilities in OpenSSL,
carefully document constant time vs. non-constant time operation
of BN_div(3), BN_mod_exp(3), and BN_mod_inverse(3).

Until the work

In view of the recent BN_FLG_CONSTTIME vulnerabilities in OpenSSL,
carefully document constant time vs. non-constant time operation
of BN_div(3), BN_mod_exp(3), and BN_mod_inverse(3).

Until the work that is required on the ill-designed BN_exp(3) and
BN_gcd(3) interfaces can be undertaken, also document the imperfections
in their behaviour, for now. Finally, mention BN_mod_exp(3) behaviour
for even moduli.

Delete the vague statement about some functions automatically
setting BN_FLG_CONSTTIME. It created a false sense of security.
Do not rely on it: not all relevant functions do that.

Topic brought up by beck@, significant feedback and OK jsing@.

show more ...

found a complete archive of SSLeay-0.4 to SSLeay-0.8.1b tarballs
on the web, so fix up SSLeay HISTORY accordingly

crypto HISTORY up to 0.9.7; researched from OpenSSL git

crypto HISTORY up to SSLeay 0.9.1; researched from OpenSSL git

bn.h HISTORY up to SSLeay 0.9.0; researched from OpenSSL git

bn.h HISTORY up to SSLeay 0.8.1b; researched from OpenSSL git

Document BN_set_flags(3) and BN_get_flags(3).
jsing@ confirmed that these macros are public and worth documenting.

correctly mark all documented macros found in <openssl/bn.h>

replace all references to bn(3) with BN_new(3),
and make sure all BN*(3) pages point back to BN_new(3)

Add Copyright and license.
Merge a sentence from OpenSSL saying that BN_sub(3)
can do in-place manipulation.

first pass; ok schwarze

document BN_set_negative() and BN_is_negative();
feedback and OK bcook@, OK jsing@

fourth batch of perlpod(1) to mdoc(7) conversion