---
name: "libressl-BN_mod_sqrt"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-BN_mod_sqrt"
---

# libressl-BN\_mod\_sqrt(3)

square root in a prime field

## NAME

**BN\_mod\_sqrt** – square root in a prime field

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/bn.h\>**

*BIGNUM* *\**\

**BN\_mod\_sqrt**(*BIGNUM \*r*, *const BIGNUM \*a*, *const BIGNUM \*p*, *BN\_CTX \*ctx*);

## DESCRIPTION

**BN\_mod\_sqrt**() solves

```
r sup 2 == a ( roman mod p )
```

for *r* in the prime field of characteristic *p* using the Tonelli-Shanks algorithm if needed and places one of the two solutions into *r*. The other solution is *p* - *r*.

The argument *p* is expected to be a prime number.

## RETURN VALUES

In case of success, **BN\_mod\_sqrt**() returns *r*, or a newly allocated *BIGNUM* object if the *r* argument is NULL.

In case of failure, NULL is returned. This for example happens if *a* is not a quadratic residue or if memory allocation fails.

## SEE ALSO

BN\_CTX\_new(3), BN\_kronecker(3), BN\_mod\_sqr(3), BN\_new(3) Henri Cohen, *A Course in Computational Algebraic Number Theory*, Springer, Berlin, 1993, Algorithm 1.5.1.

## HISTORY

**BN\_mod\_sqrt**() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.2.

## CAVEATS

If *p* is not prime, **BN\_mod\_sqrt**() may succeed or fail. If it succeeds, the square of the returned value is congruent to *a* modulo *p*. If it fails, the reason reported by ERR\_get\_error(3) is often misleading. In particular, even if *a* is a perfect square, **BN\_mod\_sqrt**() often reports “not a square” instead of “p is not prime”.