Interestingly, looks like LibreSSL avoided the BN_mod_exp bug.<p>OpenSSL history for crypto&#x2F;bn&#x2F;asm&#x2F;x86_64-mont5.pl can be seen at: <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;commits&#x2F;d73cc256c8e256c32ed959456101b73ba9842f72&#x2F;crypto&#x2F;bn&#x2F;asm&#x2F;x86_64-mont5.pl" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;commits&#x2F;d73cc256c8e256c32...</a><p>LibreSSL is using an old version of that same file found at <a href="http:&#x2F;&#x2F;cvsweb.openbsd.org&#x2F;cgi-bin&#x2F;cvsweb&#x2F;src&#x2F;lib&#x2F;libssl&#x2F;src&#x2F;crypto&#x2F;bn&#x2F;asm&#x2F;x86_64-mont5.pl" rel="nofollow">http:&#x2F;&#x2F;cvsweb.openbsd.org&#x2F;cgi-bin&#x2F;cvsweb&#x2F;src&#x2F;lib&#x2F;libssl&#x2F;src&#x2F;...</a>. LibreSSL is using a version (possibly with patches on top of it) that is at least before <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;commit&#x2F;cf6d55961cfaa00eb1852ac67cc4896b22eb8079#diff-43d1ca7cd121250ad9cdaee09e53332a" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;commit&#x2F;cf6d55961cfaa00eb1...</a>, which introduced the bug reported.<p>BoringSSL patched it here: <a href="https:&#x2F;&#x2F;boringssl.googlesource.com&#x2F;boringssl&#x2F;+&#x2F;e701f16bd69b6f251ed537e40364c281e85a63b2" rel="nofollow">https:&#x2F;&#x2F;boringssl.googlesource.com&#x2F;boringssl&#x2F;+&#x2F;e701f16bd69b6...</a><p>So, why LibreSSL went with a 2+ year old version of that file?