45 	 * Compute the actual lengths of p and q, in bytes.  in br_rsa_i15_private()
47 	 * them anyway in constant-time code).  in br_rsa_i15_private()
49 	p = sk->p;  in br_rsa_i15_private()
50 	plen = sk->plen;  in br_rsa_i15_private()
53 		plen --;  in br_rsa_i15_private()
55 	q = sk->q;  in br_rsa_i15_private()
56 	qlen = sk->qlen;  in br_rsa_i15_private()
59 		qlen --;  in br_rsa_i15_private()
63 	 * Compute the maximum factor length, in words.  in br_rsa_i15_private()
68 		z -= 15;  in br_rsa_i15_private()
84 	 * Compute signature length (in bytes).  in br_rsa_i15_private()
86 	xlen = (sk->n_bitlen + 7) >> 3;  in br_rsa_i15_private()
89 	 * Ensure 32-bit alignment for value words.  in br_rsa_i15_private()
108 	 * Compute the modulus (product of the two factors), to compare  in br_rsa_i15_private()
132 		u --;  in br_rsa_i15_private()
135 		r = ((wx - (wn + r)) >> 8) & 1;  in br_rsa_i15_private()
145 	 * Compute s2 = x^dq mod q.  in br_rsa_i15_private()
150 	r &= br_i15_modpow_opt(s2, sk->dq, sk->dqlen, mq, q0i,  in br_rsa_i15_private()
151 		mq + 3 * fwlen, TLEN - 3 * fwlen);  in br_rsa_i15_private()
154 	 * Compute s1 = x^dq mod q.  in br_rsa_i15_private()
159 	r &= br_i15_modpow_opt(s1, sk->dp, sk->dplen, mp, p0i,  in br_rsa_i15_private()
160 		mq + 4 * fwlen, TLEN - 4 * fwlen);  in br_rsa_i15_private()
163 	 * Compute:  in br_rsa_i15_private()
164 	 *   h = (s1 - s2)*(1/q) mod p  in br_rsa_i15_private()
180 	br_i15_decode_reduce(t1, sk->iq, sk->iqlen, mp);  in br_rsa_i15_private()
184 	 * h is now in t2. We compute the final result:  in br_rsa_i15_private()
186 	 * All these operations are non-modular.  in br_rsa_i15_private()