3b3e12d81e
There is no more need for the "constant-time" reading beyond bn->top. We can write the bytes out naively because RSA computations no longer call bn_correct_top/bn_set_minimal_width. Specifically, the final computation is a BN_mod_mul_montgomery to remove the blinding, and that keeps the sizes correct. Bug: 237 Change-Id: I6e90d81c323b644e179d899f411479ea16deab98 Reviewed-on: https://boringssl-review.googlesource.com/25324 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com> |
||
---|---|---|
.. | ||
aes | ||
bn | ||
cipher | ||
des | ||
digest | ||
ec | ||
ecdsa | ||
hmac | ||
md4 | ||
md5 | ||
modes | ||
policydocs | ||
rand | ||
rsa | ||
self_check | ||
sha | ||
tls | ||
bcm.c | ||
CMakeLists.txt | ||
delocate.h | ||
FIPS.md | ||
intcheck1.png | ||
intcheck2.png | ||
intcheck3.png | ||
is_fips.c |