---
name: "libressl-BN_add"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-BN_add"
---

# libressl-BN\_add(3)

arithmetic operations on BIGNUMs

## NAME

**BN\_add**, **BN\_uadd**, **BN\_sub**, **BN\_usub**, **BN\_mul**, **BN\_sqr**, **BN\_div**, **BN\_mod**, **BN\_nnmod**, **BN\_mod\_add**, **BN\_mod\_add\_quick**, **BN\_mod\_sub**, **BN\_mod\_sub\_quick**, **BN\_mod\_mul**, **BN\_mod\_sqr**, **BN\_mod\_lshift**, **BN\_mod\_lshift\_quick**, **BN\_mod\_lshift1**, **BN\_mod\_lshift1\_quick**, **BN\_exp**, **BN\_mod\_exp**, **BN\_gcd** – arithmetic operations on BIGNUMs

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/bn.h\>**

*int*\

**BN\_add**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*);

*int*\

**BN\_uadd**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*);

*int*\

**BN\_sub**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*);

*int*\

**BN\_usub**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*);

*int*\

**BN\_mul**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *BN\_CTX \*ctx*);

*int*\

**BN\_sqr**(*BIGNUM \*r*, *const BIGNUM \*a*, *BN\_CTX \*ctx*);

*int*\

**BN\_div**(*BIGNUM \*dv*, *BIGNUM \*rem*, *const BIGNUM \*a*, *const BIGNUM \*d*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod**(*BIGNUM \*rem*, *const BIGNUM \*a*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_nnmod**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_add**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_add\_quick**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *const BIGNUM \*m*);

*int*\

**BN\_mod\_sub**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_sub\_quick**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *const BIGNUM \*m*);

*int*\

**BN\_mod\_mul**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_sqr**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_lshift**(*BIGNUM \*r*, *const BIGNUM \*a*, *int n*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_lshift\_quick**(*BIGNUM \*r*, *const BIGNUM \*a*, *int n*, *const BIGNUM \*m*);

*int*\

**BN\_mod\_lshift1**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_lshift1\_quick**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*m*);

*int*\

**BN\_exp**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*p*, *BN\_CTX \*ctx*);

*int*\

**BN\_mod\_exp**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*p*, *const BIGNUM \*m*, *BN\_CTX \*ctx*);

*int*\

**BN\_gcd**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*b*, *BN\_CTX \*ctx*);

## DESCRIPTION

**BN\_add**() adds *a* and *b* and places the result in *r* (r=a+b). *r* may be the same *BIGNUM* as *a* or *b*.

**BN\_uadd**() adds the absolute values of *a* and *b* and places the result in *r* (r=\|a\|+\|b\|). *r* may be the same *BIGNUM* as *a* or *b*.

**BN\_sub**() subtracts *b* from *a* and places the result in *r* (r=a-b). *r* may be the same *BIGNUM* as *a* or *b*.

**BN\_usub**() subtracts the absolute value of *b* from the absolute value of *a* and places the result in *r* (r=\|a\|-\|b\|). It requires the absolute value of *a* to be greater than the absolute value of *b*; otherwise it will fail. *r* may be the same *BIGNUM* as *a* or *b*.

**BN\_mul**() multiplies *a* and *b* and places the result in *r* (r=a\*b). *r* may be the same *BIGNUM* as *a* or *b*. For multiplication by powers of 2, use BN\_lshift(3).

**BN\_sqr**() takes the square of *a* and places the result in *r* (r=a^2). *r* and *a* may be the same *BIGNUM*. This function is faster than **BN\_mul**(*r*, *a*, *a*).

**BN\_div**() divides *a* by *d* and places the result in *dv* and the remainder in *rem* (dv=a/d, rem=a%d). If the flag BN\_FLG\_CONSTTIME is set on *a* or *d*, it operates in constant time. Either of *dv* and *rem* may be NULL, in which case the respective value is not returned. The result is rounded towards zero; thus if *a* is negative, the remainder will be zero or negative. For division by powers of 2, use **BN\_rshift**(*3*).

**BN\_mod**() corresponds to **BN\_div**() with *dv* set to NULL. It is implemented as a macro.

**BN\_nnmod**() reduces *a* modulo *m* and places the non-negative remainder in *r*.

**BN\_mod\_add**() adds *a* to *b* modulo *m* and places the non-negative result in *r*.

**BN\_mod\_add\_quick**() is a variant of **BN\_mod\_add**() that requires *a* and *b* to both be non-negative and smaller than *m*. If any of these constraints are violated, it silently produces wrong results.

**BN\_mod\_sub**() subtracts *b* from *a* modulo *m* and places the non-negative result in *r*.

**BN\_mod\_sub\_quick**() is a variant of **BN\_mod\_sub**() that requires *a* and *b* to both be non-negative and smaller than *m*. If any of these constraints are violated, it silently produces wrong results.

**BN\_mod\_mul**() multiplies *a* by *b* and finds the non-negative remainder respective to modulus *m* (r=(a\*b)%m). *r* may be the same *BIGNUM* as *a* or *b*. For a more efficient algorithm for repeated computations using the same modulus, see BN\_mod\_mul\_montgomery(3).

**BN\_mod\_sqr**() takes the square of *a* modulo *m* and places the result in *r*.

**BN\_mod\_lshift**() shifts *a* left by *n* bits, reduces the result modulo *m*, and places the non-negative remainder in *r* (r=a\*2^n mod m).

**BN\_mod\_lshift1**() shifts *a* left by one bit, reduces the result modulo *m*, and places the non-negative remainder in *r* (r=a\*2 mod m).

**BN\_mod\_lshift\_quick**() and **BN\_mod\_lshift1\_quick**() are variants of **BN\_mod\_lshift**() and **BN\_mod\_lshift1**(), respectively, that require *a* to be non-negative and less than *m*. If either of these constraints is violated, they sometimes fail and sometimes silently produce wrong results.

**BN\_exp**() raises *a* to the *p*-th power and places the result in *r* (r=a^p). This function is faster than repeated applications of **BN\_mul**().

**BN\_mod\_exp**() computes *a* to the *p*-th power modulo *m* (r=(a^p)%m). If the flag BN\_FLG\_CONSTTIME is set on *p*, it operates in constant time. This function uses less time and space than **BN\_exp**().

**BN\_gcd**() computes the greatest common divisor of *a* and *b* and places the result in *r*. *r* may be the same *BIGNUM* as *a* or *b*.

For all functions, *ctx* is a previously allocated *BN\_CTX* used for temporary variables; see BN\_CTX\_new(3).

Unless noted otherwise, the result *BIGNUM* must be different from the arguments.

## RETURN VALUES

For all functions, 1 is returned for success, 0 on error. The return value should always be checked, for example:

```
if (!BN_add(r,a,b)) goto err;
```

The error codes can be obtained by ERR\_get\_error(3).

## SEE ALSO

BN\_add\_word(3), BN\_CTX\_new(3), BN\_new(3), BN\_set\_bit(3), BN\_set\_flags(3), BN\_set\_negative(3)

## HISTORY

**BN\_add**(), **BN\_sub**(), **BN\_mul**(), **BN\_sqr**(), **BN\_div**(), **BN\_mod**(), **BN\_mod\_mul**(), **BN\_mod\_exp**(), and **BN\_gcd**() first appeared in SSLeay 0.5.1. **BN\_exp**() first appeared in SSLeay 0.9.0. All these functions have been available since OpenBSD 2.4.

**BN\_uadd**(), **BN\_usub**(), and the *ctx* argument to **BN\_mul**() first appeared in SSLeay 0.9.1 and have been available since OpenBSD 2.6.

**BN\_nnmod**(), **BN\_mod\_add**(), **BN\_mod\_add\_quick**(), **BN\_mod\_sub**(), **BN\_mod\_sub\_quick**(), **BN\_mod\_sqr**(), **BN\_mod\_lshift**(), **BN\_mod\_lshift\_quick**(), **BN\_mod\_lshift1**(), and **BN\_mod\_lshift1\_quick**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

## BUGS

Even if the BN\_FLG\_CONSTTIME flag is set on *a* or *b*, **BN\_gcd**() neither fails nor operates in constant time, potentially allowing timing side-channel attacks.

Even if the BN\_FLG\_CONSTTIME flag is set on *p*, if the modulus *m* is even, **BN\_mod\_exp**() does not operate in constant time, potentially allowing timing side-channel attacks.

If BN\_FLG\_CONSTTIME is set on *p*, **BN\_exp**() fails instead of operating in constant time.