Aurelien Jarno c79ce88152 Fix a timing leak in ecp_mul_mxz()
The bit length of m is leaked through through timing in ecp_mul_mxz().
Initially found by Manuel Pégourié-Gonnard on ecp_mul_edxyz(), which has
been inspired from ecp_mul_mxz(), during initial review of the EdDSA PR.
See: https://github.com/Mbed-TLS/mbedtls/pull/3245#discussion_r490827996

Fix that by using grp->nbits + 1 instead, which anyway is very close to
the length of m, which means there is no significant performance impact.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2022-05-16 23:15:07 +02:00
..
2021-03-10 12:52:37 +00:00
2021-06-28 09:24:07 +01:00
2021-08-19 09:55:41 +01:00
2021-10-21 11:33:37 +02:00
2021-06-17 21:46:29 +02:00
2021-09-27 16:22:08 +02:00
2022-04-19 18:31:24 +02:00
2022-05-16 23:15:07 +02:00
2021-06-08 16:45:41 +02:00
2021-08-19 09:31:55 +01:00
2021-06-28 09:24:07 +01:00
2021-04-07 12:45:35 +01:00
2021-03-29 14:20:18 +01:00
2021-03-29 14:20:18 +01:00
2021-04-07 12:45:35 +01:00
2021-06-16 10:34:25 +02:00
2021-03-10 12:52:37 +00:00
2021-06-28 09:24:07 +01:00
2021-06-08 16:45:41 +02:00
2021-04-15 11:19:47 +01:00
2021-12-02 18:03:12 +00:00
2021-09-08 22:04:13 +05:30
2020-11-25 13:10:50 +01:00
2021-12-06 07:50:27 +01:00
2022-02-14 12:24:56 +01:00
2021-08-19 09:31:55 +01:00
2021-08-19 09:31:55 +01:00
2022-05-07 01:37:04 +00:00
2022-04-20 11:05:24 +00:00
2022-05-09 15:48:59 +08:00
2022-05-06 11:16:55 +08:00
2022-05-09 22:20:30 +08:00
2022-03-29 17:43:56 +02:00