See ChangeLog: Fri Jul 2 11:45:54 CEST 1999 Werner Koch

15 files changed, 366 insertions, 64 deletions

diff --git a/cipher/ChangeLog b/cipher/ChangeLog
index 77a3e4b82..2ce644a43 100644
--- a/cipher/ChangeLog
+++ b/cipher/ChangeLog
@@ -1,3 +1,11 @@
+Fri Jul  2 11:45:54 CEST 1999  Werner Koch  <wk@isil.d.shuttle.de>
+
+
+	* dsa.c (gen_k): Changed algorithm to consume less random bytes
+	* elgamal.c (gen_k): Ditto.
+
+	* random.c (random_dump_stats): New.
+
 Thu Jul  1 12:47:31 CEST 1999  Werner Koch  <wk@isil.d.shuttle.de>
 
 
diff --git a/cipher/dsa.c b/cipher/dsa.c
index cbd90ac5f..9154f49d6 100644
--- a/cipher/dsa.c
+++ b/cipher/dsa.c
@@ -66,30 +66,49 @@ static MPI
 gen_k( MPI q )
 {
     MPI k = mpi_alloc_secure( mpi_get_nlimbs(q) );
-    unsigned nbits = mpi_get_nbits(q);
+    unsigned int nbits = mpi_get_nbits(q);
+    unsigned int nbytes = (nbits+7)/8;
+    char *rndbuf = NULL;
 
     if( DBG_CIPHER )
 	log_debug("choosing a random k ");
     for(;;) {
 	if( DBG_CIPHER )
 	    progress('.');
-	{   char *p = get_random_bits( nbits, 1, 1 );
-	    mpi_set_buffer( k, p, (nbits+7)/8, 0 );
-	    m_free(p);
-	    /* make sure that the number is of the exact lenght */
-	    if( mpi_test_bit( k, nbits-1 ) )
-		mpi_set_highbit( k, nbits-1 );
-	    else {
-		mpi_set_highbit( k, nbits-1 );
-		mpi_clear_bit( k, nbits-1 );
-	    }
+
+	if( !rndbuf || nbits < 32 ) {
+	    m_free(rndbuf);
+	    rndbuf = get_random_bits( nbits, 1, 1 );
+	}
+	else { /* change only some of the higher bits */
+	    /* we could imporove this by directly requesting more memory
+	     * at the first call to get_random_bits() and use this the here
+	     * maybe it is easier to do this directly in random.c */
+	    char *pp = get_random_bits( 32, 1, 1 );
+	    memcpy( rndbuf,pp, 4 );
+	    m_free(pp);
 	}
-	if( !(mpi_cmp( k, q ) < 0) )  /* check: k < q */
+	mpi_set_buffer( k, rndbuf, nbytes, 0 );
+	if( mpi_test_bit( k, nbits-1 ) )
+	    mpi_set_highbit( k, nbits-1 );
+	else {
+	    mpi_set_highbit( k, nbits-1 );
+	    mpi_clear_bit( k, nbits-1 );
+	}
+
+	if( !(mpi_cmp( k, q ) < 0) ) {	/* check: k < q */
+	    if( DBG_CIPHER )
+		progress('+');
 	    continue; /* no  */
-	if( !(mpi_cmp_ui( k, 0 ) > 0) ) /* check: k > 0 */
+	}
+	if( !(mpi_cmp_ui( k, 0 ) > 0) ) { /* check: k > 0 */
+	    if( DBG_CIPHER )
+		progress('-');
 	    continue; /* no */
+	}
 	break;	/* okay */
     }
+    m_free(rndbuf);
     if( DBG_CIPHER )
 	progress('\n');
 
diff --git a/cipher/elgamal.c b/cipher/elgamal.c
index 0e6b992c0..4b9758628 100644
--- a/cipher/elgamal.c
+++ b/cipher/elgamal.c
@@ -108,7 +108,9 @@ gen_k( MPI p )
     MPI k = mpi_alloc_secure( 0 );
     MPI temp = mpi_alloc( mpi_get_nlimbs(p) );
     MPI p_1 = mpi_copy(p);
-    unsigned nbits = mpi_get_nbits(p);
+    unsigned int nbits = mpi_get_nbits(p);
+    unsigned int nbytes = (nbits+7)/8;
+    char *rndbuf = NULL;
 
     if( DBG_CIPHER )
 	log_debug("choosing a random k ");
@@ -116,9 +118,21 @@ gen_k( MPI p )
     for(;;) {
 	if( DBG_CIPHER )
 	    progress('.');
-	{   char *pp = get_random_bits( nbits, 1, 1 );
-	    mpi_set_buffer( k, pp, (nbits+7)/8, 0 );
+	if( !rndbuf || nbits < 32 ) {
+	    m_free(rndbuf);
+	    rndbuf = get_random_bits( nbits, 1, 1 );
+	}
+	else { /* change only some of the higher bits */
+	    /* we could imporove this by directly requesting more memory
+	     * at the first call to get_random_bits() and use this the here
+	     * maybe it is easier to do this directly in random.c */
+	    char *pp = get_random_bits( 32, 1, 1 );
+	    memcpy( rndbuf,pp, 4 );
 	    m_free(pp);
+	}
+	mpi_set_buffer( k, rndbuf, nbytes, 0 );
+
+	for(;;) {
 	    /* make sure that the number is of the exact lenght */
 	    if( mpi_test_bit( k, nbits-1 ) )
 		mpi_set_highbit( k, nbits-1 );
@@ -126,14 +140,23 @@ gen_k( MPI p )
 		mpi_set_highbit( k, nbits-1 );
 		mpi_clear_bit( k, nbits-1 );
 	    }
+	    if( !(mpi_cmp( k, p_1 ) < 0) ) {  /* check: k < (p-1) */
+		if( DBG_CIPHER )
+		    progress('+');
+		break; /* no  */
+	    }
+	    if( !(mpi_cmp_ui( k, 0 ) > 0) ) { /* check: k > 0 */
+		if( DBG_CIPHER )
+		    progress('-');
+		break; /* no */
+	    }
+	    if( mpi_gcd( temp, k, p_1 ) )
+		goto found;  /* okay, k is relatively prime to (p-1) */
+	    mpi_add_ui( k, k, 1 );
 	}
-	if( !(mpi_cmp( k, p_1 ) < 0) )	/* check: k < (p-1) */
-	    continue; /* no  */
-	if( !(mpi_cmp_ui( k, 0 ) > 0) ) /* check: k > 0 */
-	    continue; /* no */
-	if( mpi_gcd( temp, k, p_1 ) )
-	    break;  /* okay, k is relatively prime to (p-1) */
     }
+  found:
+    m_free(rndbuf);
     if( DBG_CIPHER )
 	progress('\n');
     mpi_free(p_1);
diff --git a/cipher/random.c b/cipher/random.c
index 5fa45ea86..8ade26c11 100644
--- a/cipher/random.c
+++ b/cipher/random.c
@@ -104,6 +104,18 @@ static void read_random_source( int requester, size_t length, int level);
 static int gather_faked( void (*add)(const void*, size_t, int), int requester,
 						    size_t length, int level );
 
+static struct {
+    ulong mixrnd;
+    ulong mixkey;
+    ulong slowpolls;
+    ulong fastpolls;
+    ulong getbytes1;
+    ulong ngetbytes1;
+    ulong getbytes2;
+    ulong ngetbytes2;
+    ulong addbytes;
+    ulong naddbytes;
+} rndstats;
 
 static void
 initialize(void)
@@ -119,6 +131,19 @@ initialize(void)
     cipher_modules_constructor();
 }
 
+
+void
+random_dump_stats()
+{
+    fprintf(stderr,
+	    "random usage: poolsize=%d mixed=%lu polls=%lu/%lu added=%lu/%lu\n"
+	    "              outmix=%lu getlvl1=%lu/%lu getlvl2=%lu/%lu\n",
+	POOLSIZE, rndstats.mixrnd, rndstats.slowpolls, rndstats.fastpolls,
+		  rndstats.naddbytes, rndstats.addbytes,
+	rndstats.mixkey, rndstats.ngetbytes1, rndstats.getbytes1,
+		    rndstats.ngetbytes2, rndstats.getbytes2 );
+}
+
 void
 secure_random_alloc()
 {
@@ -175,6 +200,15 @@ get_random_bits( size_t nbits, int level, int secure )
     if( quick_test && level > 1 )
 	level = 1;
     MASK_LEVEL(level);
+    if( level == 1 ) {
+	rndstats.getbytes1 += nbytes;
+	rndstats.ngetbytes1++;
+    }
+    else if( level >= 2 ) {
+	rndstats.getbytes2 += nbytes;
+	rndstats.ngetbytes2++;
+    }
+
     buf = secure && secure_alloc ? m_alloc_secure( nbytes ) : m_alloc( nbytes );
     for( p = buf; nbytes > 0; ) {
 	size_t n = nbytes > POOLSIZE? POOLSIZE : nbytes;
@@ -265,21 +299,23 @@ read_pool( byte *buffer, size_t length, int level )
 				    i < POOLWORDS; i++, dp++, sp++ )
 	    *dp = *sp + ADD_VALUE;
 	/* must mix both pools */
-	mix_pool(rndpool);
-	mix_pool(keypool);
+	mix_pool(rndpool); rndstats.mixrnd++;
+	mix_pool(keypool); rndstats.mixkey++;
 	memcpy( buffer, keypool, length );
     }
     else {
 	/* mix the pool (if add_randomness() didn't it) */
-	if( !just_mixed )
+	if( !just_mixed ) {
 	    mix_pool(rndpool);
+	    rndstats.mixrnd++;
+	}
 	/* create a new pool */
 	for(i=0,dp=(ulong*)keypool, sp=(ulong*)rndpool;
 				    i < POOLWORDS; i++, dp++, sp++ )
 	    *dp = *sp + ADD_VALUE;
 	/* and mix both pools */
-	mix_pool(rndpool);
-	mix_pool(keypool);
+	mix_pool(rndpool); rndstats.mixrnd++;
+	mix_pool(keypool); rndstats.mixkey++;
 	/* read the required data
 	 * we use a readpoiter to read from a different postion each
 	 * time */
@@ -308,13 +344,15 @@ add_randomness( const void *buffer, size_t length, int source )
 
     if( !is_initialized )
 	initialize();
+    rndstats.addbytes += length;
+    rndstats.naddbytes++;
     while( length-- ) {
 	rndpool[pool_writepos++] = *p++;
 	if( pool_writepos >= POOLSIZE ) {
 	    if( source > 1 )
 		pool_filled = 1;
 	    pool_writepos = 0;
-	    mix_pool(rndpool);
+	    mix_pool(rndpool); rndstats.mixrnd++;
 	    just_mixed = !length;
 	}
     }
@@ -325,6 +363,7 @@ add_randomness( const void *buffer, size_t length, int source )
 static void
 random_poll()
 {
+    rndstats.slowpolls++;
     read_random_source( 2, POOLSIZE/5, 1 );
 }
 
@@ -335,6 +374,7 @@ fast_random_poll()
     static void (*fnc)( void (*)(const void*, size_t, int), int) = NULL;
     static int initialized = 0;
 
+    rndstats.fastpolls++;
     if( !initialized ) {
 	if( !is_initialized )
 	    initialize();
diff --git a/cipher/random.h b/cipher/random.h
index 4b1d56d57..64ffdb5e6 100644
--- a/cipher/random.h
+++ b/cipher/random.h
@@ -23,6 +23,7 @@
 #include "types.h"
 
 /*-- random.c --*/
+void random_dump_stats(void);
 void secure_random_alloc(void);
 int  quick_random_gen( int onoff );
 int  random_is_faked(void);
diff --git a/g10/ChangeLog b/g10/ChangeLog
index ca68a142a..416016ef7 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,3 +1,12 @@
+Fri Jul  2 11:45:54 CEST 1999  Werner Koch  <wk@isil.d.shuttle.de>
+
+
+	* g10.c (g10_exit): Dump random stats.
+
+	* sig-check.c (check_key_signature,check_key_signature2): Enhanced
+	version and wrapper for old function.
+	(do_signature_check,signature_check): Ditto.
+
 Thu Jul  1 12:47:31 CEST 1999  Werner Koch  <wk@isil.d.shuttle.de>
 
 
diff --git a/g10/g10.c b/g10/g10.c
index 66a91bf94..48774ebd1 100644
--- a/g10/g10.c
+++ b/g10/g10.c
@@ -1326,8 +1326,10 @@ main( int argc, char **argv )
 void
 g10_exit( int rc )
 {
-    if( opt.debug & DBG_MEMSTAT_VALUE )
+    if( opt.debug & DBG_MEMSTAT_VALUE ) {
 	m_print_stats("on exit");
+	random_dump_stats();
+    }
     if( opt.debug )
 	secmem_dump_stats();
     secmem_term();
diff --git a/g10/main.h b/g10/main.h
index f2c059b33..fec9ae04d 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -80,6 +80,8 @@ int clearsign_file( const char *fname, STRLIST locusr, const char *outfile );
 
 /*-- sig-check.c --*/
 int check_key_signature( KBNODE root, KBNODE node, int *is_selfsig );
+int check_key_signature2( KBNODE root, KBNODE node,
+			  int *is_selfsig, u32 *r_expire );
 
 /*-- delkey.c --*/
 int delete_key( const char *username, int secure );
diff --git a/g10/sig-check.c b/g10/sig-check.c
index e57ae8019..4731588c6 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -39,6 +39,8 @@ struct cmp_help_context_s {
 };
 
 
+static int do_signature_check( PKT_signature *sig, MD_HANDLE digest,
+						      u32 *r_expire );
 static int do_check( PKT_public_key *pk, PKT_signature *sig,
 						MD_HANDLE digest );
 
@@ -51,16 +53,26 @@ static int do_check( PKT_public_key *pk, PKT_signature *sig,
 int
 signature_check( PKT_signature *sig, MD_HANDLE digest )
 {
+    u32 dummy;
+    return do_signature_check( sig, digest, &dummy );
+}
+
+static int
+do_signature_check( PKT_signature *sig, MD_HANDLE digest, u32 *r_expire )
+{
     PKT_public_key *pk = m_alloc_clear( sizeof *pk );
     int rc=0;
 
     if( is_RSA(sig->pubkey_algo) )
 	write_status(STATUS_RSA_OR_IDEA);
 
+    *r_expire = 0;
     if( get_pubkey( pk, sig->keyid ) )
 	rc = G10ERR_NO_PUBKEY;
-    else
+    else {
+	*r_expire = pk->expiredate;
 	rc = do_check( pk, sig, digest );
+    }
 
     free_public_key( pk );
 
@@ -398,6 +410,13 @@ hash_uid_node( KBNODE unode, MD_HANDLE md, PKT_signature *sig )
 int
 check_key_signature( KBNODE root, KBNODE node, int *is_selfsig )
 {
+    u32 dummy;
+    return check_key_signature2(root, node, is_selfsig, &dummy );
+}
+
+int
+check_key_signature2( KBNODE root, KBNODE node, int *is_selfsig, u32 *r_expire)
+{
     MD_HANDLE md;
     PKT_public_key *pk;
     PKT_signature *sig;
@@ -406,6 +425,7 @@ check_key_signature( KBNODE root, KBNODE node, int *is_selfsig )
 
     if( is_selfsig )
 	*is_selfsig = 0;
+    *r_expire = 0;
     assert( node->pkt->pkttype == PKT_SIGNATURE );
     assert( root->pkt->pkttype == PKT_PUBLIC_KEY );
 
@@ -479,7 +499,7 @@ check_key_signature( KBNODE root, KBNODE node, int *is_selfsig )
 		rc = do_check( pk, sig, md );
 	    }
 	    else
-		rc = signature_check( sig, md );
+		rc = do_signature_check( sig, md, r_expire );
 	    md_close(md);
 	}
 	else {
diff --git a/g10/trustdb.c b/g10/trustdb.c
index fa1e43a56..b386d7049 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -1142,9 +1142,15 @@ check_uidsigs( KBNODE keyblock, KBNODE keynode, u32 *mainkid, ulong lid )
     PKT_signature *selfsig = NULL; /* the latest valid self signature */
     int rc;
 
-    if( DBG_TRUST )
-	log_debug("check_uidsigs: %08lX.%lu\n",
+    if( DBG_TRUST ) {
+	PKT_user_id *uid;
+	log_debug("check_uidsigs: %08lX.%lu \"",
 			    (ulong)mainkid[1], lid );
+	assert(keynode->pkt->pkttype == PKT_USER_ID );
+	uid = keynode->pkt->pkt.user_id;
+	print_string( log_stream(), uid->name, uid->len, '\"' );
+	fputs("\"\n", log_stream());
+    }
 
     /* first we check only the selfsignatures */
     for( node=keynode->next; node; node = node->next ) {
@@ -1222,7 +1228,8 @@ check_uidsigs( KBNODE keyblock, KBNODE keynode, u32 *mainkid, ulong lid )
 
 static unsigned int
 check_sig_record( KBNODE keyblock, KBNODE signode,
-		  ulong siglid, int sigidx, u32 *keyid, ulong lid )
+		  ulong siglid, int sigidx, u32 *keyid, ulong lid,
+							u32 *r_expire )
 {
     PKT_signature *sig = signode->pkt->pkt.signature;
     unsigned int sigflag = 0;
@@ -1232,7 +1239,7 @@ check_sig_record( KBNODE keyblock, KBNODE signode,
     if( DBG_TRUST )
 	log_debug("check_sig_record: %08lX.%lu %lu[%d]\n",
 			    (ulong)keyid[1], lid, siglid, sigidx );
-
+    *r_expire = 0;
     if( (sig->sig_class&~3) == 0x10 ) /* regular certification */
 	;
     else if( sig->sig_class == 0x30 ) /* cert revocation */
@@ -1243,7 +1250,7 @@ check_sig_record( KBNODE keyblock, KBNODE signode,
     read_record( siglid, &tmp, 0 );
     if( tmp.rectype == RECTYPE_DIR ) {
 	/* the public key is in the trustdb: check sig */
-	rc = check_key_signature( keyblock, signode, NULL );
+	rc = check_key_signature2( keyblock, signode, NULL, r_expire );
 	if( !rc ) { /* valid signature */
 	    if( opt.verbose )
 		log_info("sig %08lX.%lu/%lu[%d]/%08lX: %s\n",
@@ -1307,13 +1314,15 @@ check_sig_record( KBNODE keyblock, KBNODE signode,
  * happen latter.
  */
 static ulong
-make_sig_records( KBNODE keyblock, KBNODE uidnode, ulong lid, u32 *mainkid )
+make_sig_records( KBNODE keyblock, KBNODE uidnode,
+		  ulong lid, u32 *mainkid, u32 *min_expire )
 {
     TRUSTREC *srecs, **s_end, *s=NULL, *s2;
     KBNODE  node;
     PKT_signature *sig;
     ulong sigrecno, siglid;
     int i, sigidx = 0;
+    u32 expire;
 
     srecs = NULL; s_end = &srecs;
     for( node=uidnode->next; node; node = node->next ) {
@@ -1356,7 +1365,8 @@ make_sig_records( KBNODE keyblock, KBNODE uidnode, ulong lid, u32 *mainkid )
 	s->r.sig.sig[sigidx].lid = siglid;
 	s->r.sig.sig[sigidx].flag= check_sig_record( keyblock, node,
 						     siglid, sigidx,
-						     mainkid, lid );
+						     mainkid, lid, &expire );
+
 	sigidx++;
 	if( sigidx == SIGS_PER_RECORD ) {
 	    s->recnum = tdbio_new_recnum();
@@ -1364,6 +1374,9 @@ make_sig_records( KBNODE keyblock, KBNODE uidnode, ulong lid, u32 *mainkid )
 	    s_end = &s->next;
 	    sigidx = 0;
 	}
+	/* keep track of signers pk expire time */
+	if( expire && (!*min_expire || *min_expire > expire ) )
+	    *min_expire = expire;
     }
     if( sigidx ) {
        s->recnum = tdbio_new_recnum();
@@ -1385,7 +1398,7 @@ make_sig_records( KBNODE keyblock, KBNODE uidnode, ulong lid, u32 *mainkid )
 
 
 static ulong
-make_uid_records( KBNODE keyblock, ulong lid, u32 *keyid )
+make_uid_records( KBNODE keyblock, ulong lid, u32 *keyid, u32 *min_expire )
 {
     TRUSTREC *urecs, **uend, *u, *u2;
     KBNODE  node;
@@ -1414,7 +1427,8 @@ make_uid_records( KBNODE keyblock, ulong lid, u32 *keyid )
 	    && (u->r.uid.uidflags & UIDF_VALID) )
 	    /*make_pref_record( &urec, keyid, selfsig )*/;
 	/* create the list of signatures */
-	u->r.uid.siglist = make_sig_records( keyblock, node, lid, keyid );
+	u->r.uid.siglist = make_sig_records( keyblock, node,
+					     lid, keyid, min_expire );
     }
 
     uidrecno = urecs? urecs->recnum : 0;
@@ -1443,9 +1457,10 @@ update_trust_record( KBNODE keyblock, int recheck, int *modified )
     TRUSTREC drec, krec, urec, prec, helprec;
     int rc = 0;
     u32 keyid[2]; /* keyid of primary key */
-    int mod_up = 0;
-    int mod_down = 0;
+/*    int mod_up = 0;
+    int mod_down = 0; */
     ulong recno, r2;
+    u32 expire;
 
     if( opt.dry_run )
 	return 0;
@@ -1494,7 +1509,9 @@ update_trust_record( KBNODE keyblock, int recheck, int *modified )
     /* insert new stuff */
     drec.r.dir.dirflags &= ~DIRF_REVOKED;
     drec.r.dir.keylist = make_key_records( keyblock, drec.recnum, keyid );
-    drec.r.dir.uidlist = make_uid_records( keyblock, drec.recnum, keyid );
+    expire = 0;
+    drec.r.dir.uidlist = make_uid_records( keyblock, drec.recnum, keyid,
+								 &expire );
     #if 0
 	if( orig_uidflags != urec.r.uid.uidflags ) {
 	    write_record( &urec );
@@ -1515,7 +1532,7 @@ update_trust_record( KBNODE keyblock, int recheck, int *modified )
 	    *modified = 1;
 	drec.r.dir.dirflags |= DIRF_CHECKED;
 	drec.r.dir.valcheck = 0;
-	drec.r.dir.checkat = make_timestamp();
+	drec.r.dir.checkat = expire;
 	write_record( &drec );
 	/*tdbio_write_modify_stamp( mod_up, mod_down );*/
 	rc = tdbio_end_transaction();
diff --git a/mpi/ChangeLog b/mpi/ChangeLog
index 959f3b48c..1951dd3a4 100644
--- a/mpi/ChangeLog
+++ b/mpi/ChangeLog
@@ -1,3 +1,9 @@
+Fri Jul  2 11:45:54 CEST 1999  Werner Koch  <wk@isil.d.shuttle.de>
+
+
+	* mpi-bit.c (mpi_lshift_limbs,mpi_rshift_limbs): New.
+	* mpi-mpow.c (barrett_mulm): New but diabled.
+
 Tue Jun  1 16:01:46 CEST 1999  Werner Koch  <wk@isil.d.shuttle.de>
 
 	* config.links (i[56]86*-*-freebsdelf*): New.
diff --git a/mpi/mpi-bit.c b/mpi/mpi-bit.c
index 00aa5d086..f1eff8636 100644
--- a/mpi/mpi-bit.c
+++ b/mpi/mpi-bit.c
@@ -212,3 +212,51 @@ mpi_rshift( MPI x, MPI a, unsigned n )
     x->nlimbs = xsize;
 }
 
+
+/****************
+ * Shift A by COUNT limbs to the left
+ * This is used only within the MPI library
+ */
+void
+mpi_lshift_limbs( MPI a, unsigned int count )
+{
+    mpi_ptr_t ap = a->d;
+    int n = a->nlimbs;
+    int i;
+
+    if( !count || !n )
+	return;
+
+    RESIZE_IF_NEEDED( a, n+count );
+
+    for( i = n-1; i >= 0; i-- )
+	ap[i+count] = ap[i];
+    for(i=0; i < count; i++ )
+	ap[i] = 0;
+    a->nlimbs += count;
+}
+
+
+/****************
+ * Shift A by COUNT limbs to the right
+ * This is used only within the MPI library
+ */
+void
+mpi_rshift_limbs( MPI a, unsigned int count )
+{
+    mpi_ptr_t ap = a->d;
+    mpi_size_t n = a->nlimbs;
+    unsigned int i;
+
+    if( count >= n ) {
+	a->nlimbs = 0;
+	return;
+    }
+
+    for( i = 0; i < n - count; i++ )
+	ap[i] = ap[i+count];
+    ap[i] = 0;
+    a->nlimbs -= count;
+}
+
+
diff --git a/mpi/mpi-internal.h b/mpi/mpi-internal.h
index f73efb76c..035d33cb3 100644
--- a/mpi/mpi-internal.h
+++ b/mpi/mpi-internal.h
@@ -161,6 +161,11 @@ typedef int mpi_size_t;        /* (must be a signed type) */
 #endif
 void mpi_assign_limb_space( MPI a, mpi_ptr_t ap, unsigned nlimbs );
 
+/*-- mpi-bit.c --*/
+void mpi_rshift_limbs( MPI a, unsigned int count );
+void mpi_lshift_limbs( MPI a, unsigned int count );
+
+
 /*-- mpihelp-add.c --*/
 mpi_limb_t mpihelp_add_1(mpi_ptr_t res_ptr,  mpi_ptr_t s1_ptr,
 			 mpi_size_t s1_size, mpi_limb_t s2_limb );
diff --git a/mpi/mpi-mpow.c b/mpi/mpi-mpow.c
index 689a7600f..a8c561dd1 100644
--- a/mpi/mpi-mpow.c
+++ b/mpi/mpi-mpow.c
@@ -1,5 +1,5 @@
 /* mpi-mpow.c  -  MPI functions
- *	Copyright (C) 1998 Free Software Foundation, Inc.
+ *	Copyright (C) 1998, 1999 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -25,6 +25,22 @@
 #include "longlong.h"
 #include <assert.h>
 
+/* Barrett is slower than the classical way.  It can be tweaked by
+ * using partial multiplications
+ */
+/*#define USE_BARRETT*/
+
+
+
+#ifdef USE_BARRETT
+static void barrett_mulm( MPI w, MPI u, MPI v, MPI m, MPI y, int k, MPI r1, MPI r2 );
+static MPI init_barrett( MPI m, int *k, MPI *r1, MPI *r2 );
+static int calc_barrett( MPI r, MPI x, MPI m, MPI y, int k, MPI r1, MPI r2  );
+#else
+#define barrett_mulm( w, u, v, m, y, k, r1, r2 ) mpi_mulm( (w), (u), (v), (m) )
+#endif
+
+
 static int
 build_index( MPI *exparray, int k, int i, int t )
 {
@@ -52,6 +68,10 @@ mpi_mulpowm( MPI res, MPI *basearray, MPI *exparray, MPI m)
     int i, j, idx;
     MPI *G;	/* table with precomputed values of size 2^k */
     MPI tmp;
+  #ifdef USE_BARRETT
+    MPI barrett_y, barrett_r1, barrett_r2;
+    int barrett_k;
+  #endif
 
     for(k=0; basearray[k]; k++ )
 	;
@@ -68,27 +88,15 @@ mpi_mulpowm( MPI res, MPI *basearray, MPI *exparray, MPI m)
     assert( k < 10 );
 
     G = m_alloc_clear( (1<<k) * sizeof *G );
-  #if 0
-    /* do the precomputation */
-    G[0] = mpi_alloc_set_ui( 1 );
-    for(i=1; i < (1<<k); i++ ) {
-	for(j=0; j < k; j++ ) {
-	    if( (i & (1<<j) ) ) {
-		if( !G[i] )
-		    G[i] = mpi_copy( basearray[j] );
-		else
-		    mpi_mulm( G[i], G[i], basearray[j], m );
-	    }
-	}
-	if( !G[i] )
-	    G[i] = mpi_alloc(0);
-    }
+  #ifdef USE_BARRETT
+    barrett_y = init_barrett( m, &barrett_k, &barrett_r1, &barrett_r2 );
   #endif
     /* and calculate */
     tmp =  mpi_alloc( mpi_get_nlimbs(m)+1 );
     mpi_set_ui( res, 1 );
     for(i = 1; i <= t; i++ ) {
-	mpi_mulm(tmp, res, res, m );
+	barrett_mulm(tmp, res, res, m, barrett_y, barrett_k,
+				       barrett_r1, barrett_r2 );
 	idx = build_index( exparray, k, i, t );
 	assert( idx >= 0 && idx < (1<<k) );
 	if( !G[idx] ) {
@@ -100,20 +108,115 @@ mpi_mulpowm( MPI res, MPI *basearray, MPI *exparray, MPI m)
 			if( !G[idx] )
 			    G[idx] = mpi_copy( basearray[j] );
 			else
-			    mpi_mulm( G[idx], G[idx], basearray[j], m );
+			    barrett_mulm( G[idx], G[idx], basearray[j],
+					       m, barrett_y, barrett_k, barrett_r1, barrett_r2	);
 		    }
 		}
 		if( !G[idx] )
 		    G[idx] = mpi_alloc(0);
 	    }
 	}
-	mpi_mulm(res, tmp, G[idx], m );
+	barrett_mulm(res, tmp, G[idx], m, barrett_y, barrett_k, barrett_r1, barrett_r2	);
     }
 
     /* cleanup */
     mpi_free(tmp);
+  #ifdef USE_BARRETT
+    mpi_free(barrett_y);
+    mpi_free(barrett_r1);
+    mpi_free(barrett_r2);
+  #endif
     for(i=0; i < (1<<k); i++ )
 	mpi_free(G[i]);
     m_free(G);
 }
 
+
+
+#ifdef USE_BARRETT
+static void
+barrett_mulm( MPI w, MPI u, MPI v, MPI m, MPI y, int k, MPI r1, MPI r2	)
+{
+    mpi_mul(w, u, v);
+    if( calc_barrett( w, w, m, y, k, r1, r2 ) )
+	mpi_fdiv_r( w, w, m );
+}
+
+/****************
+ * Barrett precalculation: y = floor(b^(2k) / m)
+ */
+static MPI
+init_barrett( MPI m, int *k, MPI *r1, MPI *r2 )
+{
+    MPI tmp;
+
+    mpi_normalize( m );
+    *k = mpi_get_nlimbs( m );
+    tmp = mpi_alloc( *k + 1 );
+    mpi_set_ui( tmp, 1 );
+    mpi_lshift_limbs( tmp, 2 * *k );
+    mpi_fdiv_q( tmp, tmp, m );
+    *r1 = mpi_alloc( 2* *k + 1 );
+    *r2 = mpi_alloc( 2* *k + 1 );
+    return tmp;
+}
+
+/****************
+ * Barrett reduction: We assume that these conditions are met:
+ * Given x =(x_2k-1 ...x_0)_b
+ *	 m =(m_k-1 ....m_0)_b	  with m_k-1 != 0
+ * Output r = x mod m
+ * Before using this function init_barret must be used to calucalte y and k.
+ * Returns: false = no error
+ *	    true = can't perform barret reduction
+ */
+static int
+calc_barrett( MPI r, MPI x, MPI m, MPI y, int k, MPI r1, MPI r2 )
+{
+    int xx = k > 3 ? k-3:0;
+
+    mpi_normalize( x );
+    if( mpi_get_nlimbs(x) > 2*k )
+	return 1; /* can't do it */
+
+    /* 1. q1 = floor( x / b^k-1)
+     *	  q2 = q1 * y
+     *	  q3 = floor( q2 / b^k+1 )
+     * Actually, we don't need qx, we can work direct on r2
+     */
+    mpi_set( r2, x );
+    mpi_rshift_limbs( r2, k-1 );
+    mpi_mul( r2, r2, y );
+    mpi_rshift_limbs( r2, k+1 );
+
+    /* 2. r1 = x mod b^k+1
+     *	  r2 = q3 * m mod b^k+1
+     *	  r  = r1 - r2
+     * 3. if r < 0 then  r = r + b^k+1
+     */
+    mpi_set( r1, x );
+    if( r1->nlimbs > k+1 ) /* quick modulo operation */
+	r1->nlimbs = k+1;
+    mpi_mul( r2, r2, m );
+    if( r2->nlimbs > k+1 ) /* quick modulo operation */
+	r2->nlimbs = k+1;
+    mpi_sub( r, r1, r2 );
+
+    if( mpi_is_neg( r ) ) {
+	MPI tmp;
+
+	tmp = mpi_alloc( k + 2 );
+	mpi_set_ui( tmp, 1 );
+	mpi_lshift_limbs( tmp, k+1 );
+	mpi_add( r, r, tmp );
+	mpi_free(tmp);
+    }
+
+    /* 4. while r >= m do r = r - m */
+    while( mpi_cmp( r, m ) >= 0 )
+	mpi_sub( r, r, m );
+
+    return 0;
+}
+#endif /* USE_BARRETT */
+
diff --git a/mpi/mpi-mul.c b/mpi/mpi-mul.c
index f83824926..df8eb2586 100644
--- a/mpi/mpi-mul.c
+++ b/mpi/mpi-mul.c
@@ -189,7 +189,6 @@ mpi_mul( MPI w, MPI u, MPI v)
 }
 
 
-
 void
 mpi_mulm( MPI w, MPI u, MPI v, MPI m)
 {