if (!BN_mod(R,Y,n,ctx)) goto err;
if (BN_ucmp(Y,n) < 0) if (!BN_copy(R,Y)) goto err; else if (!BN_nnmod(R,Y,n,ctx)) goto err;
BIGNUM *BN_mod_inverse(BIGNUM *in,	const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)	{	BIGNUM *A,*B,*X,*Y,*M,*D,*R=NULL;	BIGNUM *ret=NULL;	int sign;	bn_check_top(a);	bn_check_top(n);	BN_CTX_start(ctx);	A = BN_CTX_get(ctx);	B = BN_CTX_get(ctx);	X = BN_CTX_get(ctx);	D = BN_CTX_get(ctx);	M = BN_CTX_get(ctx);	Y = BN_CTX_get(ctx);	if (Y == NULL) goto err;	if (in == NULL)		R=BN_new();	else		R=in;	if (R == NULL) goto err;	BN_one(X);	BN_zero(Y);	if (BN_copy(B,a) == NULL) goto err;	if (BN_copy(A,n) == NULL) goto err;	A->neg = 0;	if (B->neg || (BN_ucmp(B, A) >= 0))		{		if (!BN_nnmod(B, B, A, ctx)) goto err;		}	sign = -1;	/* From  B = a mod |n|,  A = |n|  it follows that	 *	 *      0 <= B < A,	 *           X*a  ==  B   (mod |n|),	 *     -sign*Y*a  ==  A   (mod |n|).	 */	while (!BN_is_zero(B))		{		BIGNUM *tmp;		/*		 *      0 < B < A,		 * (*)       X*a  ==  B   (mod |n|),		 *     -sign*Y*a  ==  A   (mod |n|)		 */		if (!BN_div(D,M,A,B,ctx)) goto err;		/* Now		 *      A = D*B + M;		 * thus we have		 * (**) -sign*Y*a  ==  D*B + M   (mod |n|).		 */				tmp=A; /* keep the BIGNUM object, the value does not matter */		/* (A, B) := (B, A mod B) ... */		A=B;		B=M;		/* ... so we have  0 <= B < A  again */		/* Since the former  M  is now  B  and the former  B  is now  A,		 * (**) translates into		 *      -sign*Y*a  ==  D*A + B    (mod |n|),		 * i.e.		 *      -sign*Y*a - D*A  ==  B    (mod |n|).		 * Similarly, (*) translates into		 *      X*a  ==  A          (mod |n|).		 *		 * Thus,		 *      -sign*Y*a - D*X*a  ==  B  (mod |n|),		 * i.e.		 *      -sign*(Y + D*X)*a  ==  B  (mod |n|).		 *		 * So if we set  (X, Y, sign) := (Y + D*X, X, -sign),  we arrive back at		 *            X*a  ==  B   (mod |n|),		 *      -sign*Y*a  ==  A   (mod |n|).		 * Note that  X  and  Y  stay non-negative all the time.		 */		if (!BN_mul(tmp,D,X,ctx)) goto err;		if (!BN_add(tmp,tmp,Y)) goto err;		M=Y; /* keep the BIGNUM object, the value does not matter */		Y=X;		X=tmp;		sign = -sign;		}	/*	 * The while loop ends when	 *      A == gcd(a,n);	 * we have	 *      -sign*Y*a  ==  A  (mod |n|),	 * where  Y  is non-negative.	 */	if (sign < 0)		{		if (!BN_sub(Y,n,Y)) goto err;		}	/* Now  Y*a  ==  A  (mod |n|).  */		if (BN_is_one(A))		{		/* Y*a == 1  (mod |n|) */		if (!BN_mod(R,Y,n,ctx)) goto err;		}	else		{		BNerr(BN_F_BN_MOD_INVERSE,BN_R_NO_INVERSE);		goto err;		}	ret=R;err:	if ((ret == NULL) && (in == NULL)) BN_free(R);	BN_CTX_end(ctx);	return(ret);	}