---
name: "libressl-BN_set_flags"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-BN_set_flags"
---

# libressl-BN\_set\_flags(3)

enable and inspect flags on BIGNUM objects

## NAME

**BN\_set\_flags**, **BN\_get\_flags** – enable and inspect flags on BIGNUM objects

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/bn.h\>**

*void*\

**BN\_set\_flags**(*BIGNUM \*b*, *int flags*);

*int*\

**BN\_get\_flags**(*const BIGNUM \*b*, *int flags*);

## DESCRIPTION

**BN\_set\_flags**() enables the given *flags* on *b*. The *flags* argument can contain zero or more of the following constants OR'ed together:

- BN\_FLG\_CONSTTIME

  If this flag is set on the divident *a* or the divisor *d* in BN\_div(3), on the exponent *p* in BN\_mod\_exp(3), or on the divisor *a* or the modulus *n* in BN\_mod\_inverse(3), these functions select algorithms with an execution time independent of the respective numbers, to avoid exposing sensitive information to timing side-channel attacks.

  This flag is off by default for *BIGNUM* objects created with BN\_new(3).

- BN\_FLG\_MALLOCED

  If this flag is set, BN\_free(3) and BN\_clear\_free(3) will not only clear and free the components of *b*, but also *b* itself. This flag is set internally by BN\_new(3). Setting it manually on an existing *BIGNUM* object is usually a bad idea and can cause calls to [free(3)](/free/3.md) with bogus arguments.

- BN\_FLG\_STATIC\_DATA

  If this flag is set, BN\_clear\_free(3) will neither clear nor free the memory used for storing the number. Consequently, setting it manually on an existing *BIGNUM* object is usually a terrible idea that can cause both disclosure of secret data and memory leaks. This flag is automatically set on the constant *BIGNUM* object returned by BN\_value\_one(3).

**BN\_get\_flags**() interprets *flags* as a bitmask and returns those of the given flags that are set in *b*, OR'ed together, or 0 if none of the given *flags* is set. The *flags* argument has the same syntax as for **BN\_set\_flags**().

## RETURN VALUES

**BN\_get\_flags**() returns zero or more of the above constants, OR'ed together.

## SEE ALSO

BN\_mod\_exp(3), BN\_mod\_inverse(3), BN\_new(3), BN\_with\_flags(3)

## HISTORY

**BN\_set\_flags**() and **BN\_get\_flags**() first appeared in SSLeay 0.9.1 and have been available since OpenBSD 2.6.

## CAVEATS

No public interface exists to clear a flag once it is set. So think twice before using **BN\_set\_flags**().

## BUGS

Even if the BN\_FLG\_CONSTTIME flag is set on *a* or *b*, **BN\_gcd**() neither fails nor operates in constant time, potentially allowing timing side-channel attacks.

Even if the BN\_FLG\_CONSTTIME flag is set on *p*, if the modulus *m* is even, BN\_mod\_exp(3) does not operate in constant time, potentially allowing timing side-channel attacks.

If BN\_FLG\_CONSTTIME is set on *p*, **BN\_exp**() fails instead of operating in constant time.