ec/ecdsa_ossl.c: revert blinding in ECDSA signature.
authorAndy Polyakov <appro@openssl.org>
Fri, 6 Jul 2018 13:55:34 +0000 (15:55 +0200)
committerAndy Polyakov <appro@openssl.org>
Fri, 27 Jul 2018 12:49:35 +0000 (14:49 +0200)
commit6040bd3f7109dcae508c3194232e7b8ee8654dc0
tree9b14604ae02b7f1818e0b19f6d2a6839cf5a4cc0
parent2f19065bd35dc84492c4c47ff5b706340300866f
ec/ecdsa_ossl.c: revert blinding in ECDSA signature.

Originally suggested solution for "Return Of the Hidden Number Problem"
is arguably too expensive. While it has marginal impact on slower
curves, none to ~6%, optimized implementations suffer real penalties.
Most notably sign with P-256 went more than 2 times[!] slower. Instead,
just implement constant-time BN_mod_add_quick.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6796)

(cherry picked from commit 3fc7a9b96cbed0c3da6f53c08e34d8d0c982745f)

Resolved conflicts:
crypto/ec/ecdsa_ossl.c
crypto/bn/bn_mod.c
crypto/ec/ecdsa_ossl.c
crypto/include/internal/bn_int.h