165 		ret = local_memcpy(&adata[4], oid, oid_len); EG(ret, err);  in bign_set_adata()
173 		ret = local_memcpy(&adata[4 + oid_len], t, t_len); EG(ret, err);  in bign_set_adata()
220 	ret = nn_check_initialized(q); EG(ret, err);  in __bign_determinitic_nonce()
221 	ret = nn_check_initialized(x); EG(ret, err);  in __bign_determinitic_nonce()
223 	ret = local_memset(theta, 0, sizeof(theta)); EG(ret, err);  in __bign_determinitic_nonce()
224 	ret = local_memset(FE2OS_D, 0, sizeof(FE2OS_D)); EG(ret, err);  in __bign_determinitic_nonce()
225 	ret = local_memset(r_bar, 0, sizeof(r_bar)); EG(ret, err);  in __bign_determinitic_nonce()
233 	ret = bign_get_oid_from_adata(adata, adata_len, &oid_ptr, &oid_len); EG(ret, err);  in __bign_determinitic_nonce()
234 	ret = bign_get_t_from_adata(adata, adata_len, &t_ptr, &t_len); EG(ret, err);  in __bign_determinitic_nonce()
236 	ret = belt_hash_init(&belt_hash_ctx); EG(ret, err);  in __bign_determinitic_nonce()
237 	ret = belt_hash_update(&belt_hash_ctx, oid_ptr, oid_len); EG(ret, err);  in __bign_determinitic_nonce()
240 	ret = local_memset(FE2OS_D, 0, sizeof(FE2OS_D)); EG(ret, err);  in __bign_determinitic_nonce()
241 	ret = nn_export_to_buf(&FE2OS_D[0], q_len, x); EG(ret, err);  in __bign_determinitic_nonce()
242 	ret = _reverse_endianness(&FE2OS_D[0], q_len); EG(ret, err);  in __bign_determinitic_nonce()
244 	ret = belt_hash_update(&belt_hash_ctx, &FE2OS_D[0], (u32)(2*l)); EG(ret, err);  in __bign_determinitic_nonce()
246 	ret = belt_hash_update(&belt_hash_ctx, t_ptr, t_len); EG(ret, err);  in __bign_determinitic_nonce()
248 	ret = belt_hash_final(&belt_hash_ctx, theta); EG(ret, err);  in __bign_determinitic_nonce()
257 	ret = local_memcpy(r, h, hlen); EG(ret, err);  in __bign_determinitic_nonce()
276 		ret = local_memset(s, 0, sizeof(s)); EG(ret, err);  in __bign_determinitic_nonce()
285 		ret = local_memcpy(&r[0], &r[BELT_BLOCK_LEN], (n - 2) * BELT_BLOCK_LEN); EG(ret, err);  in __bign_determinitic_nonce()
288 		ret = local_memset(i_block, 0, sizeof(i_block)); EG(ret, err);  in __bign_determinitic_nonce()
296 		ret = local_memcpy(&r[(n - 1) * BELT_BLOCK_LEN], s, BELT_BLOCK_LEN); EG(ret, err);  in __bign_determinitic_nonce()
303 			ret = local_memcpy(&r_bar[0], &r[0], r_bar_len); EG(ret, err);  in __bign_determinitic_nonce()
317 			ret = local_memcpy(&r_bar[0], &r[0], r_bar_len); EG(ret, err);  in __bign_determinitic_nonce()
319 		ret = _reverse_endianness(&r_bar[0], r_bar_len); EG(ret, err);  in __bign_determinitic_nonce()
320 		ret = nn_init_from_buf(k, &r_bar[0], r_bar_len); EG(ret, err);  in __bign_determinitic_nonce()
323 		ret = nn_cmp(k, q, &cmp); EG(ret, err);  in __bign_determinitic_nonce()
325 		ret = nn_iszero(k, &iszero); EG(ret, err);  in __bign_determinitic_nonce()
355 	ret = local_memset(out_pub, 0, sizeof(ec_pub_key)); EG(ret, err);  in __bign_init_pub_key()
357 	ret = priv_key_check_initialized_and_type(in_priv, key_type); EG(ret, err);  in __bign_init_pub_key()
366 	ret = prj_pt_mul_blind(&(out_pub->y), &(in_priv->x), G); EG(ret, err);  in __bign_init_pub_key()
415 	ret = sig_sign_check_initialized(ctx); EG(ret, err);  in __bign_sign_init()
418 	ret = key_pair_check_initialized_and_type(ctx->key_pair, key_type); EG(ret, err);  in __bign_sign_init()
433 	ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err);  in __bign_sign_init()
434 	ret = ctx->h->hfunc_init(&(ctx->sign_data.bign.h_ctx)); EG(ret, err);  in __bign_sign_init()
453 	ret = sig_sign_check_initialized(ctx); EG(ret, err);  in __bign_sign_update()
457 	ret = key_pair_check_initialized_and_type(ctx->key_pair, key_type); EG(ret, err);  in __bign_sign_update()
461 	ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err);  in __bign_sign_update()
500 	ret = sig_sign_check_initialized(ctx); EG(ret, err);  in __bign_sign_finalize()
505 	ret = key_pair_check_initialized_and_type(ctx->key_pair, key_type); EG(ret, err);  in __bign_sign_finalize()
508 	ret = local_memset(&kG, 0, sizeof(prj_pt)); EG(ret, err);  in __bign_sign_finalize()
526 	ret = nn_cmp(x, q, &cmp); EG(ret, err);  in __bign_sign_finalize()
547 	ret = local_memset(hash, 0, hsize); EG(ret, err);  in __bign_sign_finalize()
549 	ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err);  in __bign_sign_finalize()
550 	ret = ctx->h->hfunc_finalize(&(ctx->sign_data.bign.h_ctx), hash); EG(ret, err);  in __bign_sign_finalize()
605 	ret = nn_get_random_mod(&b, q); EG(ret, err);  in __bign_sign_finalize()
609 	ret = nn_modinv_fermat(&binv, &b, q); EG(ret, err);  in __bign_sign_finalize()
617 	ret = prj_pt_mul_blind(&kG, &k, G); EG(ret, err);  in __bign_sign_finalize()
619 	ret = prj_pt_mul(&kG, &k, G); EG(ret, err);  in __bign_sign_finalize()
621 	ret = prj_pt_unique(&kG, &kG); EG(ret, err);  in __bign_sign_finalize()
627 	ret = belt_hash_init(&belt_hash_ctx); EG(ret, err);  in __bign_sign_finalize()
628 	ret = bign_get_oid_from_adata(ctx->adata, ctx->adata_len, &oid_ptr, &oid_len); EG(ret, err);  in __bign_sign_finalize()
629 	ret = belt_hash_update(&belt_hash_ctx, oid_ptr, oid_len); EG(ret, err);  in __bign_sign_finalize()
631 	ret = local_memset(FE2OS_W, 0, sizeof(FE2OS_W)); EG(ret, err);  in __bign_sign_finalize()
632 	ret = fp_export_to_buf(&FE2OS_W[0],  p_len, &(kG.X)); EG(ret, err);  in __bign_sign_finalize()
633 	ret = _reverse_endianness(&FE2OS_W[0],  p_len); EG(ret, err);  in __bign_sign_finalize()
634 	ret = fp_export_to_buf(&FE2OS_W[p_len], p_len, &(kG.Y)); EG(ret, err);  in __bign_sign_finalize()
635 	ret = _reverse_endianness(&FE2OS_W[p_len], p_len); EG(ret, err);  in __bign_sign_finalize()
637 	ret = belt_hash_update(&belt_hash_ctx, &FE2OS_W[0], (u32)(2*l)); EG(ret, err);  in __bign_sign_finalize()
639 	ret = belt_hash_update(&belt_hash_ctx, hash, hsize); EG(ret, err);  in __bign_sign_finalize()
641 	ret = local_memset(hash_belt, 0, sizeof(hash_belt)); EG(ret, err);  in __bign_sign_finalize()
642 	ret = belt_hash_final(&belt_hash_ctx, hash_belt); EG(ret, err);  in __bign_sign_finalize()
643 	ret = local_memset(&sig[0], 0, l); EG(ret, err);  in __bign_sign_finalize()
644 	ret = local_memcpy(&sig[0], &hash_belt[0], LOCAL_MIN(l, BELT_HASH_DIGEST_SIZE)); EG(ret, err);  in __bign_sign_finalize()
650 	ret = _reverse_endianness(hash, hsize); EG(ret, err);  in __bign_sign_finalize()
651 	ret = nn_init_from_buf(&h, hash, hsize); EG(ret, err);  in __bign_sign_finalize()
652 	ret = nn_mod(&h, &h, q); EG(ret, err);  in __bign_sign_finalize()
654 	ret = local_memcpy(FE2OS_W, &sig[0], l); EG(ret, err);  in __bign_sign_finalize()
655 	ret = _reverse_endianness(FE2OS_W, l); EG(ret, err);  in __bign_sign_finalize()
656 	ret = nn_init_from_buf(&s1, FE2OS_W, l); EG(ret, err);  in __bign_sign_finalize()
657 	ret = nn_mod(&s1, &s1, q); EG(ret, err);  in __bign_sign_finalize()
659 	ret = nn_init(&tmp, 0); EG(ret, err);  in __bign_sign_finalize()
660 	ret = nn_one(&tmp); EG(ret, err);  in __bign_sign_finalize()
661 	ret = nn_lshift(&tmp, &tmp, (bitcnt_t)(8*l)); EG(ret, err);  in __bign_sign_finalize()
662 	ret = nn_mod(&tmp, &tmp, q); EG(ret, err);  in __bign_sign_finalize()
663 	ret = nn_mod_add(&s1, &s1, &tmp, q); EG(ret, err);  in __bign_sign_finalize()
666 	ret = nn_mod_mul(&s1, &s1, &b, q); EG(ret, err);  in __bign_sign_finalize()
669 	ret = nn_mod_mul(&h, &h, &b, q); EG(ret, err);  in __bign_sign_finalize()
672 	ret = nn_mod_mul(&k, &k, &b, q); EG(ret, err);  in __bign_sign_finalize()
675 	ret = nn_mod_mul(&s1, &s1, &(priv_key->x), q); EG(ret, err);  in __bign_sign_finalize()
676 	ret = nn_mod_sub(&s1, &k, &s1, q); EG(ret, err);  in __bign_sign_finalize()
677 	ret = nn_mod_sub(&s1, &s1, &h, q); EG(ret, err);  in __bign_sign_finalize()
681 	ret = nn_mod_mul(&s1, &s1, &binv, q); EG(ret, err);  in __bign_sign_finalize()
686 	ret = local_memset(hash, 0, hsize); EG(ret, err);  in __bign_sign_finalize()
689 	ret = nn_export_to_buf(&sig[l], (u16)BIGN_S1_LEN(q_bit_len), &s1); EG(ret, err);  in __bign_sign_finalize()
754 	ret = sig_verify_check_initialized(ctx); EG(ret, err);  in __bign_verify_init()
756 	ret = local_memset(TMP, 0, sizeof(TMP)); EG(ret, err);  in __bign_verify_init()
759 	ret = pub_key_check_initialized_and_type(ctx->pub_key, key_type); EG(ret, err);  in __bign_verify_init()
783 	ret = local_memcpy(s0_sig, sig, l); EG(ret, err);  in __bign_verify_init()
786 	ret = local_memcpy(&TMP[0], sig, l); EG(ret, err);  in __bign_verify_init()
787 	ret = _reverse_endianness(&TMP[0], l); EG(ret, err);  in __bign_verify_init()
788 	ret = nn_init_from_buf(s0, &TMP[0], l); EG(ret, err);  in __bign_verify_init()
790 	ret = local_memcpy(&TMP[0], &sig[l], (u32)BIGN_S1_LEN(q_bit_len)); EG(ret, err);  in __bign_verify_init()
791 	ret = _reverse_endianness(&TMP[0], (u16)BIGN_S1_LEN(q_bit_len)); EG(ret, err);  in __bign_verify_init()
792 	ret = nn_init_from_buf(s1, &TMP[0], (u8)BIGN_S1_LEN(q_bit_len)); EG(ret, err);  in __bign_verify_init()
797 	ret = nn_cmp(s1, q, &cmp); EG(ret, err);  in __bign_verify_init()
802 	ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err);  in __bign_verify_init()
803 	ret = ctx->h->hfunc_init(&(ctx->verify_data.bign.h_ctx)); EG(ret, err);  in __bign_verify_init()
828 	ret = sig_verify_check_initialized(ctx); EG(ret, err);  in __bign_verify_update()
831 	ret = pub_key_check_initialized_and_type(ctx->pub_key, key_type); EG(ret, err);  in __bign_verify_update()
835 	ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err);  in __bign_verify_update()
874 	ret = sig_verify_check_initialized(ctx); EG(ret, err);  in __bign_verify_finalize()
877 	ret = pub_key_check_initialized_and_type(ctx->pub_key, key_type); EG(ret, err);  in __bign_verify_finalize()
885 	ret = local_memset(&uG, 0, sizeof(prj_pt)); EG(ret, err);  in __bign_verify_finalize()
886 	ret = local_memset(&vY, 0, sizeof(prj_pt)); EG(ret, err);  in __bign_verify_finalize()
908 	ret = hash_mapping_callbacks_sanity_check(ctx->h); EG(ret, err);  in __bign_verify_finalize()
909 	ret = ctx->h->hfunc_finalize(&(ctx->verify_data.bign.h_ctx), hash); EG(ret, err);  in __bign_verify_finalize()
913 	ret = _reverse_endianness(hash, hsize); EG(ret, err);  in __bign_verify_finalize()
914 	ret = nn_init_from_buf(&h, hash, hsize); EG(ret, err);  in __bign_verify_finalize()
915 	ret = nn_mod(&h, &h, q); EG(ret, err);  in __bign_verify_finalize()
919 	ret = _reverse_endianness(hash, hsize); EG(ret, err);  in __bign_verify_finalize()
922 	ret = nn_mod_add(&h, &h, s1, q); EG(ret, err);  in __bign_verify_finalize()
924 	ret = nn_init(&tmp, 0); EG(ret, err);  in __bign_verify_finalize()
925 	ret = nn_one(&tmp); EG(ret, err);  in __bign_verify_finalize()
926 	ret = nn_lshift(&tmp, &tmp, (bitcnt_t)(8*l)); EG(ret, err);  in __bign_verify_finalize()
927 	ret = nn_mod(&tmp, &tmp, q); EG(ret, err);  in __bign_verify_finalize()
928 	ret = nn_mod_add(&tmp, &tmp, s0, q); EG(ret, err);  in __bign_verify_finalize()
931 	ret = prj_pt_mul(&uG, &h, G); EG(ret, err);  in __bign_verify_finalize()
932 	ret = prj_pt_mul(&vY, &tmp, Y); EG(ret, err);  in __bign_verify_finalize()
933 	ret = prj_pt_add(W, &uG, &vY); EG(ret, err);  in __bign_verify_finalize()
935 	ret = prj_pt_iszero(W, &iszero); EG(ret, err);  in __bign_verify_finalize()
937 	ret = prj_pt_unique(W, W); EG(ret, err);  in __bign_verify_finalize()
940 	ret = belt_hash_init(&belt_hash_ctx); EG(ret, err);  in __bign_verify_finalize()
941 	ret = bign_get_oid_from_adata(ctx->adata, ctx->adata_len, &oid_ptr, &oid_len); EG(ret, err);  in __bign_verify_finalize()
942 	ret = belt_hash_update(&belt_hash_ctx, oid_ptr, oid_len); EG(ret, err);  in __bign_verify_finalize()
944 	ret = local_memset(FE2OS_W, 0, sizeof(FE2OS_W)); EG(ret, err);  in __bign_verify_finalize()
945 	ret = fp_export_to_buf(&FE2OS_W[0], p_len, &(W->X)); EG(ret, err);  in __bign_verify_finalize()
946 	ret = _reverse_endianness(&FE2OS_W[0], p_len); EG(ret, err);  in __bign_verify_finalize()
947 	ret = fp_export_to_buf(&FE2OS_W[p_len], p_len, &(W->Y)); EG(ret, err);  in __bign_verify_finalize()
948 	ret = _reverse_endianness(&FE2OS_W[p_len], p_len); EG(ret, err);  in __bign_verify_finalize()
950 	ret = belt_hash_update(&belt_hash_ctx, &FE2OS_W[0], (u32)(2*l)); EG(ret, err);  in __bign_verify_finalize()
952 	ret = belt_hash_update(&belt_hash_ctx, hash, hsize); EG(ret, err);  in __bign_verify_finalize()
954 	ret = local_memset(hash_belt, 0, sizeof(hash_belt)); EG(ret, err);  in __bign_verify_finalize()
955 	ret = belt_hash_final(&belt_hash_ctx, hash_belt); EG(ret, err);  in __bign_verify_finalize()
956 	ret = local_memset(&t[0], 0, l); EG(ret, err);  in __bign_verify_finalize()
957 	ret = local_memcpy(&t[0], &hash_belt[0], LOCAL_MIN(l, BELT_HASH_DIGEST_SIZE)); EG(ret, err);  in __bign_verify_finalize()
960 	ret = are_equal(t, s0_sig, l, &cmp); EG(ret, err);  in __bign_verify_finalize()