ecdsa/ecs_ossl.c: revert blinding in ECDSA signature.
authorAndy Polyakov <appro@openssl.org>
Fri, 6 Jul 2018 13:55:34 +0000 (15:55 +0200)
committerAndy Polyakov <appro@openssl.org>
Wed, 1 Aug 2018 14:15:17 +0000 (16:15 +0200)
commit83325a68ad5fdfc359ab9d82a0e0da8e5fe7ede1
treead32da61ff030b8846054e614e5cc402b09cb629
parentc9046a05ec0fc3377e1077b401652d76ee5ce908
ecdsa/ecs_ossl.c: revert blinding in ECDSA signature.

Originally suggested solution for "Return Of the Hidden Number Problem"
is arguably too expensive. While it has marginal impact on slower
curves, none to ~6%, optimized implementations suffer real penalties.
Most notably sign with P-256 went more than 2 times[!] slower. Instead,
just implement constant-time BN_mod_add_quick.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6810)

(cherry picked from commit 3fc7a9b96cbed0c3da6f53c08e34d8d0c982745f)

Resolved onflicts:
crypto/ec/ecdsa_ossl.c
crypto/include/internal/bn_int.h
crypto/bn/bn_mod.c
crypto/bn_int.h
crypto/ecdsa/ecs_ossl.c