mp_clear(&shift);
makePfromQandSeed(      unsigned int  L,          /* Length of P in bits.  Per FIPS 186. */      unsigned int  offset,     /* Per FIPS 186, appendix 2.2. */      unsigned int  g,          /* input.  Length of seed in bits. */const SECItem   *   seed,       /* input.  */const mp_int    *   Q,          /* input.  */      mp_int    *   P)          /* output. */{    unsigned int  k;            /* Per FIPS 186, appendix 2.2. */    unsigned int  n;            /* Per FIPS 186, appendix 2.2. */    mp_digit      b;            /* Per FIPS 186, appendix 2.2. */    unsigned char V_k[SHA1_LENGTH];    mp_int        W, X, c, twoQ, V_n, tmp, shift;    mp_err    err = MP_OKAY;    SECStatus rv  = SECSuccess;    /* Initialize bignums */    MP_DIGITS(&W)     = 0;    MP_DIGITS(&X)     = 0;    MP_DIGITS(&c)     = 0;    MP_DIGITS(&twoQ)  = 0;    MP_DIGITS(&V_n)   = 0;    MP_DIGITS(&tmp)   = 0;    MP_DIGITS(&shift) = 0;    CHECK_MPI_OK( mp_init(&W)    );    CHECK_MPI_OK( mp_init(&X)    );    CHECK_MPI_OK( mp_init(&c)    );    CHECK_MPI_OK( mp_init(&twoQ) );    CHECK_MPI_OK( mp_init(&tmp)  );    CHECK_MPI_OK( mp_init(&V_n)  );    CHECK_MPI_OK( mp_init(&shift));    /* L - 1 = n*160 + b */    n = (L - 1) / BITS_IN_Q;    b = (L - 1) % BITS_IN_Q;    /* ******************************************************************    ** Step 7.    **  "for k = 0 ... n let    **           V_k = SHA[(SEED + offset + k) mod 2**g]."    **    ** Step 8.    **  "Let W be the integer     **    W = V_0 + (V_1 * 2**160) + ... + (V_n-1 * 2**((n-1)*160))     **         + ((V_n mod 2**b) * 2**(n*160))    */    for (k=0; k<n; ++k) { /* Do the first n-1 terms of V_k */	/* Do step 7 for iteration k.	** V_k = SHA[(seed + offset + k) mod 2**g]	*/	CHECK_SEC_OK( addToSeedThenSHA(seed, offset + k, g, V_k) );	/* Do step 8 for iteration k.	** W += V_k * 2**(k*160)	*/	OCTETS_TO_MPINT(V_k, &tmp, SHA1_LENGTH);           /* get bignum V_k */	CHECK_MPI_OK( mp_2expt(&shift, (mp_digit)k*160) ); /* 2**(k*160)     */	CHECK_MPI_OK( mp_mul(&tmp, &shift, &tmp) );        /* V_k << shift   */	CHECK_MPI_OK( mp_add(&W, &tmp, &W) );              /* W += tmp       */    }    /* Step 8, continued.    **   [W += ((V_n mod 2**b) * 2**(n*160))]     */    CHECK_SEC_OK( addToSeedThenSHA(seed, offset + n, g, V_k) );    OCTETS_TO_MPINT(V_k, &V_n, SHA1_LENGTH);           /* get bignum V_n     */    CHECK_MPI_OK( mp_div_2d(&V_n, b, NULL, &tmp) );    /* tmp = V_n mod 2**b */    CHECK_MPI_OK( mp_2expt(&shift, (mp_digit)n*160) ); /* 2**(n*160)         */    CHECK_MPI_OK( mp_mul(&tmp, &shift, &tmp) );        /* tmp << shift       */    CHECK_MPI_OK( mp_add(&W, &tmp, &W) );              /* W += tmp           */    /* Step 8, continued.    ** "and let X = W + 2**(L-1).    **  Note that 0 <= W < 2**(L-1) and hence 2**(L-1) <= X < 2**L."    */    CHECK_MPI_OK( mpl_set_bit(&X, (mp_size)(L-1), 1) );    /* X = 2**(L-1) */    CHECK_MPI_OK( mp_add(&X, &W, &X) );                    /* X += W       */    /*************************************************************    ** Step 9.    ** "Let c = X mod 2q  and set p = X - (c - 1).    **  Note that p is congruent to 1 mod 2q."    */    CHECK_MPI_OK( mp_mul_2(Q, &twoQ) );                    /* 2q           */    CHECK_MPI_OK( mp_mod(&X, &twoQ, &c) );                 /* c = X mod 2q */    CHECK_MPI_OK( mp_sub_d(&c, 1, &c) );                   /* c -= 1       */    CHECK_MPI_OK( mp_sub(&X, &c, P) );                     /* P = X - c    */cleanup:    mp_clear(&W);    mp_clear(&X);    mp_clear(&c);    mp_clear(&twoQ);    mp_clear(&V_n);    mp_clear(&tmp);    mp_clear(&shift);    if (err) {	MP_TO_SEC_ERROR(err);	return SECFailure;    }    return rv;}