diff --git a/crypto/Makefile b/crypto/Makefile

index 8bc5850..3a2bc51 100644

--- a/crypto/Makefile

+++ b/crypto/Makefile

@@ -45,7 +45,7 @@ SRC= $(LIBSRC)

 EXHEADER= crypto.h opensslv.h opensslconf.h ebcdic.h symhacks.h \

 	ossl_typ.h

 HEADER=	cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h \

-	constant_time_locl.h $(EXHEADER)

+	constant_time_locl.h bn_int.h $(EXHEADER)

 ALL=    $(GENERAL) $(SRC) $(HEADER)

diff --git a/crypto/bn/bn.h b/crypto/bn/bn.h

index b37f6ec..0e6e30f 100644

--- a/crypto/bn/bn.h

+++ b/crypto/bn/bn.h

@@ -702,6 +702,16 @@ BIGNUM *bn_dup_expand(const BIGNUM *a, int words); /* unused */

 /* We only need assert() when debugging */

 #  include <assert.h>

+/*

+ * The new BN_FLG_FIXED_TOP flag marks vectors that were not treated with

+ * bn_correct_top, in other words such vectors are permitted to have zeros

+ * in most significant limbs. Such vectors are used internally to achieve

+ * execution time invariance for critical operations with private keys.

+ * It's BN_DEBUG-only flag, because user application is not supposed to

+ * observe it anyway. Moreover, optimizing compiler would actually remove

+ * all operations manipulating the bit in question in non-BN_DEBUG build.

+ */

+#  define BN_FLG_FIXED_TOP 0x10000

 #  ifdef BN_DEBUG_RAND

 /* To avoid "make update" cvs wars due to BN_DEBUG, use some tricks */

 #   ifndef RAND_pseudo_bytes

@@ -734,8 +744,10 @@ int RAND_pseudo_bytes(unsigned char *buf, int num);

         do { \

                 const BIGNUM *_bnum2 = (a); \

                 if (_bnum2 != NULL) { \

-                        assert((_bnum2->top == 0) || \

-                                (_bnum2->d[_bnum2->top - 1] != 0)); \

+                        int _top = _bnum2->top; \

+                        assert((_top == 0) || \

+                               (_bnum2->flags & BN_FLG_FIXED_TOP) || \

+                               (_bnum2->d[_top - 1] != 0)); \

                         bn_pollute(_bnum2); \

                 } \

         } while(0)

@@ -753,6 +765,7 @@ int RAND_pseudo_bytes(unsigned char *buf, int num);

 # else                          /* !BN_DEBUG */

+#  define BN_FLG_FIXED_TOP 0

 #  define bn_pollute(a)

 #  define bn_check_top(a)

 #  define bn_fix_top(a)           bn_correct_top(a)

diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c

index bc37671..460d8b7 100644

--- a/crypto/bn/bn_div.c

+++ b/crypto/bn/bn_div.c

@@ -290,6 +290,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,

     wnum.neg = 0;

     wnum.d = &(snum->d[loop]);

     wnum.top = div_n;

+    wnum.flags = BN_FLG_STATIC_DATA;

     /*

      * only needed when BN_ucmp messes up the values between top and max

      */

diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c

index 195a786..816a198 100644

--- a/crypto/bn/bn_exp.c

+++ b/crypto/bn/bn_exp.c

@@ -466,17 +466,17 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

         ret = 1;

         goto err;

     }

-    if (!BN_to_montgomery(val[0], aa, mont, ctx))

+    if (!bn_to_mont_fixed_top(val[0], aa, mont, ctx))

         goto err;               /* 1 */

     window = BN_window_bits_for_exponent_size(bits);

     if (window > 1) {

-        if (!BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx))

+        if (!bn_mul_mont_fixed_top(d, val[0], val[0], mont, ctx))

             goto err;           /* 2 */

         j = 1 << (window - 1);

         for (i = 1; i < j; i++) {

             if (((val[i] = BN_CTX_get(ctx)) == NULL) ||

-                !BN_mod_mul_montgomery(val[i], val[i - 1], d, mont, ctx))

+                !bn_mul_mont_fixed_top(val[i], val[i - 1], d, mont, ctx))

                 goto err;

         }

     }

@@ -498,19 +498,15 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

         for (i = 1; i < j; i++)

             r->d[i] = (~m->d[i]) & BN_MASK2;

         r->top = j;

-        /*

-         * Upper words will be zero if the corresponding words of 'm' were

-         * 0xfff[...], so decrement r->top accordingly.

-         */

-        bn_correct_top(r);

+        r->flags |= BN_FLG_FIXED_TOP;

     } else

 #endif

-    if (!BN_to_montgomery(r, BN_value_one(), mont, ctx))

+    if (!bn_to_mont_fixed_top(r, BN_value_one(), mont, ctx))

         goto err;

     for (;;) {

         if (BN_is_bit_set(p, wstart) == 0) {

             if (!start) {

-                if (!BN_mod_mul_montgomery(r, r, r, mont, ctx))

+                if (!bn_mul_mont_fixed_top(r, r, r, mont, ctx))

                     goto err;

             }

             if (wstart == 0)

@@ -541,12 +537,12 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

         /* add the 'bytes above' */

         if (!start)

             for (i = 0; i < j; i++) {

-                if (!BN_mod_mul_montgomery(r, r, r, mont, ctx))

+                if (!bn_mul_mont_fixed_top(r, r, r, mont, ctx))

                     goto err;

             }

         /* wvalue will be an odd number < 2^window */

-        if (!BN_mod_mul_montgomery(r, r, val[wvalue >> 1], mont, ctx))

+        if (!bn_mul_mont_fixed_top(r, r, val[wvalue >> 1], mont, ctx))

             goto err;

         /* move the 'window' down further */

@@ -556,6 +552,11 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

         if (wstart < 0)

             break;

     }

+    /*

+     * Done with zero-padded intermediate BIGNUMs. Final BN_from_montgomery

+     * removes padding [if any] and makes return value suitable for public

+     * API consumer.

+     */

 #if defined(SPARC_T4_MONT)

     if (OPENSSL_sparcv9cap_P[0] & (SPARCV9_VIS3 | SPARCV9_PREFER_FPU)) {

         j = mont->N.top;        /* borrow j */

@@ -674,7 +675,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,

     }

     b->top = top;

-    bn_correct_top(b);

+    b->flags |= BN_FLG_FIXED_TOP;

     return 1;

 }

@@ -841,16 +842,16 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

         tmp.top = top;

     } else

 #endif

-    if (!BN_to_montgomery(&tmp, BN_value_one(), mont, ctx))

+    if (!bn_to_mont_fixed_top(&tmp, BN_value_one(), mont, ctx))

         goto err;

     /* prepare a^1 in Montgomery domain */

     if (a->neg || BN_ucmp(a, m) >= 0) {

         if (!BN_mod(&am, a, m, ctx))

             goto err;

-        if (!BN_to_montgomery(&am, &am, mont, ctx))

+        if (!bn_to_mont_fixed_top(&am, &am, mont, ctx))

             goto err;

-    } else if (!BN_to_montgomery(&am, a, mont, ctx))

+    } else if (!bn_to_mont_fixed_top(&am, a, mont, ctx))

         goto err;

 #if defined(SPARC_T4_MONT)

@@ -1117,14 +1118,14 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

          * performance advantage of sqr over mul).

          */

         if (window > 1) {

-            if (!BN_mod_mul_montgomery(&tmp, &am, &am, mont, ctx))

+            if (!bn_mul_mont_fixed_top(&tmp, &am, &am, mont, ctx))

                 goto err;

             if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, 2,

                                               window))

                 goto err;

             for (i = 3; i < numPowers; i++) {

                 /* Calculate a^i = a^(i-1) * a */

-                if (!BN_mod_mul_montgomery(&tmp, &am, &tmp, mont, ctx))

+                if (!bn_mul_mont_fixed_top(&tmp, &am, &tmp, mont, ctx))

                     goto err;

                 if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, i,

                                                   window))

@@ -1148,7 +1149,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

             /* Scan the window, squaring the result as we go */

             for (i = 0; i < window; i++, bits--) {

-                if (!BN_mod_mul_montgomery(&tmp, &tmp, &tmp, mont, ctx))

+                if (!bn_mul_mont_fixed_top(&tmp, &tmp, &tmp, mont, ctx))

                     goto err;

                 wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);

             }

@@ -1161,12 +1162,16 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,

                 goto err;

             /* Multiply the result into the intermediate result */

-            if (!BN_mod_mul_montgomery(&tmp, &tmp, &am, mont, ctx))

+            if (!bn_mul_mont_fixed_top(&tmp, &tmp, &am, mont, ctx))

                 goto err;

         }

     }

-    /* Convert the final result from montgomery to standard format */

+    /*

+     * Done with zero-padded intermediate BIGNUMs. Final BN_from_montgomery

+     * removes padding [if any] and makes return value suitable for public

+     * API consumer.

+     */

 #if defined(SPARC_T4_MONT)

     if (OPENSSL_sparcv9cap_P[0] & (SPARCV9_VIS3 | SPARCV9_PREFER_FPU)) {

         am.d[0] = 1;            /* borrow am */

diff --git a/crypto/bn/bn_lcl.h b/crypto/bn/bn_lcl.h

index 00f4f09..1aa7fe8 100644

--- a/crypto/bn/bn_lcl.h

+++ b/crypto/bn/bn_lcl.h

@@ -113,6 +113,7 @@

 # define HEADER_BN_LCL_H

 # include <openssl/bn.h>

+# include "bn_int.h"

 #ifdef  __cplusplus

 extern "C" {

diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c

index 10b78f5..e42e3fb 100644

--- a/crypto/bn/bn_lib.c

+++ b/crypto/bn/bn_lib.c

@@ -290,8 +290,6 @@ static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)

     const BN_ULONG *B;

     int i;

-    bn_check_top(b);

-

     if (words > (INT_MAX / (4 * BN_BITS2))) {

         BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);

         return NULL;

@@ -425,8 +423,6 @@ BIGNUM *bn_dup_expand(const BIGNUM *b, int words)

 BIGNUM *bn_expand2(BIGNUM *b, int words)

 {

-    bn_check_top(b);

-

     if (words > b->dmax) {

         BN_ULONG *a = bn_expand_internal(b, words);

         if (!a)

@@ -460,7 +456,6 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)

         assert(A == &(b->d[b->dmax]));

     }

 #endif

-    bn_check_top(b);

     return b;

 }

@@ -572,6 +567,7 @@ void BN_clear(BIGNUM *a)

         OPENSSL_cleanse(a->d, a->dmax * sizeof(a->d[0]));

     a->top = 0;

     a->neg = 0;

+    a->flags &= ~BN_FLG_FIXED_TOP;

 }

 BN_ULONG BN_get_word(const BIGNUM *a)

@@ -592,6 +588,7 @@ int BN_set_word(BIGNUM *a, BN_ULONG w)

     a->neg = 0;

     a->d[0] = w;

     a->top = (w ? 1 : 0);

+    a->flags &= ~BN_FLG_FIXED_TOP;

     bn_check_top(a);

     return (1);

 }

@@ -738,6 +735,7 @@ int BN_set_bit(BIGNUM *a, int n)

         for (k = a->top; k < i + 1; k++)

             a->d[k] = 0;

         a->top = i + 1;

+        a->flags &= ~BN_FLG_FIXED_TOP;

     }

     a->d[i] |= (((BN_ULONG)1) << j);

diff --git a/crypto/bn/bn_mod.c b/crypto/bn/bn_mod.c

index ffbce89..23ddd48 100644

--- a/crypto/bn/bn_mod.c

+++ b/crypto/bn/bn_mod.c

@@ -149,16 +149,71 @@ int BN_mod_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,

 /*

  * BN_mod_add variant that may be used if both a and b are non-negative and

- * less than m

+ * less than m. The original algorithm was

+ *

+ *    if (!BN_uadd(r, a, b))

+ *       return 0;

+ *    if (BN_ucmp(r, m) >= 0)

+ *       return BN_usub(r, r, m);

+ *

+ * which is replaced with addition, subtracting modulus, and conditional

+ * move depending on whether or not subtraction borrowed.

  */

+int bn_mod_add_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

+                         const BIGNUM *m)

+{

+    size_t i, ai, bi, mtop = m->top;

+    BN_ULONG storage[1024 / BN_BITS2];

+    BN_ULONG carry, temp, mask, *rp, *tp = storage;

+    const BN_ULONG *ap, *bp;

+

+    if (bn_wexpand(r, m->top) == NULL)

+        return 0;

+

+    if (mtop > sizeof(storage) / sizeof(storage[0])

+        && (tp = OPENSSL_malloc(mtop * sizeof(BN_ULONG))) == NULL)

+	return 0;

+

+    ap = a->d != NULL ? a->d : tp;

+    bp = b->d != NULL ? b->d : tp;

+

+    for (i = 0, ai = 0, bi = 0, carry = 0; i < mtop;) {

+        mask = (BN_ULONG)0 - ((i - a->top) >> (8 * sizeof(i) - 1));

+        temp = ((ap[ai] & mask) + carry) & BN_MASK2;

+        carry = (temp < carry);

+

+        mask = (BN_ULONG)0 - ((i - b->top) >> (8 * sizeof(i) - 1));

+        tp[i] = ((bp[bi] & mask) + temp) & BN_MASK2;

+        carry += (tp[i] < temp);

+

+        i++;

+        ai += (i - a->dmax) >> (8 * sizeof(i) - 1);

+        bi += (i - b->dmax) >> (8 * sizeof(i) - 1);

+    }

+    rp = r->d;

+    carry -= bn_sub_words(rp, tp, m->d, mtop);

+    for (i = 0; i < mtop; i++) {

+        rp[i] = (carry & tp[i]) | (~carry & rp[i]);

+        ((volatile BN_ULONG *)tp)[i] = 0;

+    }

+    r->top = mtop;

+    r->neg = 0;

+

+    if (tp != storage)

+        OPENSSL_free(tp);

+

+    return 1;

+}

+

 int BN_mod_add_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

                      const BIGNUM *m)

 {

-    if (!BN_uadd(r, a, b))

-        return 0;

-    if (BN_ucmp(r, m) >= 0)

-        return BN_usub(r, r, m);

-    return 1;

+    int ret = bn_mod_add_fixed_top(r, a, b, m);

+

+    if (ret)

+        bn_correct_top(r);

+

+    return ret;

 }

 int BN_mod_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,

diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c

index be95bd5..d41434a 100644

--- a/crypto/bn/bn_mont.c

+++ b/crypto/bn/bn_mont.c

@@ -56,7 +56,7 @@

  * [including the GNU Public Licence.]

  */

 /* ====================================================================

- * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.

+ * Copyright (c) 1998-2018 The OpenSSL Project.  All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

@@ -123,11 +123,22 @@

 #define MONT_WORD               /* use the faster word-based algorithm */

 #ifdef MONT_WORD

-static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont);

+static int bn_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont);

 #endif

 int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

                           BN_MONT_CTX *mont, BN_CTX *ctx)

+{

+    int ret = bn_mul_mont_fixed_top(r, a, b, mont, ctx);

+

+    bn_correct_top(r);

+    bn_check_top(r);

+

+    return ret;

+}

+

+int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

+                          BN_MONT_CTX *mont, BN_CTX *ctx)

 {

     BIGNUM *tmp;

     int ret = 0;

@@ -140,8 +151,8 @@ int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

         if (bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num)) {

             r->neg = a->neg ^ b->neg;

             r->top = num;

-            bn_correct_top(r);

-            return (1);

+            r->flags |= BN_FLG_FIXED_TOP;

+            return 1;

         }

     }

 #endif

@@ -161,13 +172,12 @@ int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

     }

     /* reduce from aRR to aR */

 #ifdef MONT_WORD

-    if (!BN_from_montgomery_word(r, tmp, mont))

+    if (!bn_from_montgomery_word(r, tmp, mont))

         goto err;

 #else

     if (!BN_from_montgomery(r, tmp, mont, ctx))

         goto err;

 #endif

-    bn_check_top(r);

     ret = 1;

  err:

     BN_CTX_end(ctx);

@@ -175,7 +185,7 @@ int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

 }

 #ifdef MONT_WORD

-static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)

+static int bn_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)

 {

     BIGNUM *n;

     BN_ULONG *ap, *np, *rp, n0, v, carry;

@@ -205,28 +215,16 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)

 # endif

     r->top = max;

+    r->flags |= BN_FLG_FIXED_TOP;

     n0 = mont->n0[0];

-# ifdef BN_COUNT

-    fprintf(stderr, "word BN_from_montgomery_word %d * %d\n", nl, nl);

-# endif

+    /*

+     * Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On

+     * input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r|

+     * includes |carry| which is stored separately.

+     */

     for (carry = 0, i = 0; i < nl; i++, rp++) {

-# ifdef __TANDEM

-        {

-            long long t1;

-            long long t2;

-            long long t3;

-            t1 = rp[0] * (n0 & 0177777);

-            t2 = 037777600000l;

-            t2 = n0 & t2;

-            t3 = rp[0] & 0177777;

-            t2 = (t3 * t2) & BN_MASK2;

-            t1 = t1 + t2;

-            v = bn_mul_add_words(rp, np, nl, (BN_ULONG)t1);

-        }

-# else

         v = bn_mul_add_words(rp, np, nl, (rp[0] * n0) & BN_MASK2);

-# endif

         v = (v + carry + rp[nl]) & BN_MASK2;

         carry |= (v != rp[nl]);

         carry &= (v <= rp[nl]);

@@ -236,52 +234,27 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)

     if (bn_wexpand(ret, nl) == NULL)

         return (0);

     ret->top = nl;

+    ret->flags |= BN_FLG_FIXED_TOP;

     ret->neg = r->neg;

     rp = ret->d;

+

+    /*

+     * Shift |nl| words to divide by R. We have |ap| < 2 * |n|. Note that |ap|

+     * includes |carry| which is stored separately.

+     */

     ap = &(r->d[nl]);

-# define BRANCH_FREE 1

-# if BRANCH_FREE

-    {

-        BN_ULONG *nrp;

-        size_t m;

-

-        v = bn_sub_words(rp, ap, np, nl) - carry;

-        /*

-         * if subtraction result is real, then trick unconditional memcpy

-         * below to perform in-place "refresh" instead of actual copy.

-         */

-        m = (0 - (size_t)v);

-        nrp =

-            (BN_ULONG *)(((PTR_SIZE_INT) rp & ~m) | ((PTR_SIZE_INT) ap & m));

-

-        for (i = 0, nl -= 4; i < nl; i += 4) {

-            BN_ULONG t1, t2, t3, t4;

-

-            t1 = nrp[i + 0];

-            t2 = nrp[i + 1];

-            t3 = nrp[i + 2];

-            ap[i + 0] = 0;

-            t4 = nrp[i + 3];

-            ap[i + 1] = 0;

-            rp[i + 0] = t1;

-            ap[i + 2] = 0;

-            rp[i + 1] = t2;

-            ap[i + 3] = 0;

-            rp[i + 2] = t3;

-            rp[i + 3] = t4;

-        }

-        for (nl += 4; i < nl; i++)

-            rp[i] = nrp[i], ap[i] = 0;

+    carry -= bn_sub_words(rp, ap, np, nl);

+    /*

+     * |carry| is -1 if |ap| - |np| underflowed or zero if it did not. Note

+     * |carry| cannot be 1. That would imply the subtraction did not fit in

+     * |nl| words, and we know at most one subtraction is needed.

+     */

+    for (i = 0; i < nl; i++) {

+        rp[i] = (carry & ap[i]) | (~carry & rp[i]);

+        ap[i] = 0;

     }

-# else

-    if (bn_sub_words(rp, ap, np, nl) - carry)

-        memcpy(rp, ap, nl * sizeof(BN_ULONG));

-# endif

-    bn_correct_top(r);

-    bn_correct_top(ret);

-    bn_check_top(ret);

     return (1);

 }

@@ -295,8 +268,11 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,

     BIGNUM *t;

     BN_CTX_start(ctx);

-    if ((t = BN_CTX_get(ctx)) && BN_copy(t, a))

-        retn = BN_from_montgomery_word(ret, t, mont);

+    if ((t = BN_CTX_get(ctx)) && BN_copy(t, a)) {

+        retn = bn_from_montgomery_word(ret, t, mont);

+        bn_correct_top(ret);

+        bn_check_top(ret);

+    }

     BN_CTX_end(ctx);

 #else                           /* !MONT_WORD */

     BIGNUM *t1, *t2;

@@ -334,6 +310,12 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,

     return (retn);

 }

+int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,

+                         BN_CTX *ctx)

+{

+    return bn_mul_mont_fixed_top(r, a, &(mont->RR), mont, ctx);

+}

+

 BN_MONT_CTX *BN_MONT_CTX_new(void)

 {

     BN_MONT_CTX *ret;

@@ -370,7 +352,7 @@ void BN_MONT_CTX_free(BN_MONT_CTX *mont)

 int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)

 {

-    int ret = 0;

+    int i, ret = 0;

     BIGNUM *Ri, *R;

     if (BN_is_zero(mod))

@@ -382,6 +364,8 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)

     R = &(mont->RR);            /* grab RR as a temp */

     if (!BN_copy(&(mont->N), mod))

         goto err;               /* Set N */

+    if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

+        BN_set_flags(&(mont->N), BN_FLG_CONSTTIME);

     mont->N.neg = 0;

 #ifdef MONT_WORD

@@ -394,6 +378,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)

         tmod.dmax = 2;

         tmod.neg = 0;

+        if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

+            BN_set_flags(&tmod, BN_FLG_CONSTTIME);

+

         mont->ri = (BN_num_bits(mod) + (BN_BITS2 - 1)) / BN_BITS2 * BN_BITS2;

 # if defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32)

@@ -496,6 +483,11 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)

     if (!BN_mod(&(mont->RR), &(mont->RR), &(mont->N), ctx))

         goto err;

+    for (i = mont->RR.top, ret = mont->N.top; i < ret; i++)

+        mont->RR.d[i] = 0;

+    mont->RR.top = ret;

+    mont->RR.flags |= BN_FLG_FIXED_TOP;

+

     ret = 1;

  err:

     BN_CTX_end(ctx);

diff --git a/crypto/bn/bn_sqr.c b/crypto/bn/bn_sqr.c

index 256d26e..5e69297 100644

--- a/crypto/bn/bn_sqr.c

+++ b/crypto/bn/bn_sqr.c

@@ -135,14 +135,8 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)

     }

     rr->neg = 0;

-    /*

-     * If the most-significant half of the top word of 'a' is zero, then the

-     * square of 'a' will max-1 words.

-     */

-    if (a->d[al - 1] == (a->d[al - 1] & BN_MASK2l))

-        rr->top = max - 1;

-    else

-        rr->top = max;

+    rr->top = max;

+    bn_correct_top(rr);

     if (r != rr && BN_copy(r, rr) == NULL)

         goto err;

diff -up openssl-1.0.2k/crypto/bn_int.h.rohnp-fix openssl-1.0.2k/crypto/bn_int.h

--- openssl-1.0.2k/crypto/bn_int.h.rohnp-fix   2018-08-14 10:57:21.597518822 +0200

+++ openssl-1.0.2k/crypto/bn_int.h     2018-08-14 10:57:21.599518871 +0200

@@ -0,0 +1,13 @@

+/*

+ * Some BIGNUM functions assume most significant limb to be non-zero, which

+ * is customarily arranged by bn_correct_top. Output from below functions

+ * is not processed with bn_correct_top, and for this reason it may not be

+ * returned out of public API. It may only be passed internally into other

+ * functions known to support non-minimal or zero-padded BIGNUMs.

+ */

+int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

+                          BN_MONT_CTX *mont, BN_CTX *ctx);

+int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,

+                         BN_CTX *ctx);

+int bn_mod_add_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,

+                         const BIGNUM *m);

diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c

index b5f67bd..894dff8 100644

--- a/crypto/dsa/dsa_ossl.c

+++ b/crypto/dsa/dsa_ossl.c

@@ -136,8 +136,7 @@ const DSA_METHOD *DSA_OpenSSL(void)

 static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)

 {

     BIGNUM *kinv = NULL, *r = NULL, *s = NULL;

-    BIGNUM m;

-    BIGNUM xr;

+    BIGNUM *m, *blind, *blindm, *tmp;

     BN_CTX *ctx = NULL;

     int reason = ERR_R_BN_LIB;

     DSA_SIG *ret = NULL;

@@ -156,9 +155,6 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)

     }

 #endif

-    BN_init(&m);

-    BN_init(&xr);

-

     if (!dsa->p || !dsa->q || !dsa->g) {

         reason = DSA_R_MISSING_PARAMETERS;

         goto err;

@@ -170,6 +166,14 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)

     ctx = BN_CTX_new();

     if (ctx == NULL)

         goto err;

+    BN_CTX_start(ctx);

+    m = BN_CTX_get(ctx);

+    blind = BN_CTX_get(ctx);

+    blindm = BN_CTX_get(ctx);

+    tmp = BN_CTX_get(ctx);

+    if (tmp == NULL)

+        goto err;

+

  redo:

     if ((dsa->kinv == NULL) || (dsa->r == NULL)) {

         if (!DSA_sign_setup(dsa, ctx, &kinv, &r))

@@ -189,20 +193,52 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)

          * 4.2

          */

         dlen = BN_num_bytes(dsa->q);

-    if (BN_bin2bn(dgst, dlen, &m) == NULL)

+    if (BN_bin2bn(dgst, dlen, m) == NULL)

         goto err;

-    /* Compute  s = inv(k) (m + xr) mod q */

-    if (!BN_mod_mul(&xr, dsa->priv_key, r, dsa->q, ctx))

-        goto err;               /* s = xr */

-    if (!BN_add(s, &xr, &m))

-        goto err;               /* s = m + xr */

-    if (BN_cmp(s, dsa->q) > 0)

-        if (!BN_sub(s, s, dsa->q))

+    /*

+     * The normal signature calculation is:

+     *

+     *   s := k^-1 * (m + r * priv_key) mod q

+     *

+     * We will blind this to protect against side channel attacks

+     *

+     *   s := blind^-1 * k^-1 * (blind * m + blind * r * priv_key) mod q

+     */

+

+    /* Generate a blinding value */

+    do {

+        if (!BN_rand(blind, BN_num_bits(dsa->q) - 1, -1, 0))

             goto err;

+    } while (BN_is_zero(blind));

+    BN_set_flags(blind, BN_FLG_CONSTTIME);

+    BN_set_flags(blindm, BN_FLG_CONSTTIME);

+    BN_set_flags(tmp, BN_FLG_CONSTTIME);

+

+    /* tmp := blind * priv_key * r mod q */

+    if (!BN_mod_mul(tmp, blind, dsa->priv_key, dsa->q, ctx))