David Benjamin 73df153be8 Make BN_generate_dsa_nonce internally constant-time. ... This rewrites the internals with a "words" variant that can avoid bn_correct_top. It still ultimately calls bn_correct_top as the calling convention is sadly still BIGNUM, but we can lift that calling convention out incrementally. Performance seems to be comparable, if not faster. Before: Did 85000 ECDSA P-256 signing operations in 5030401us (16897.3 ops/sec) Did 34278 ECDSA P-256 verify operations in 5048029us (6790.4 ops/sec) After: Did 85000 ECDSA P-256 signing operations in 5021057us (16928.7 ops/sec) Did 34086 ECDSA P-256 verify operations in 5010416us (6803.0 ops/sec) Change-Id: I1159746dfcc00726dc3f28396076a354556e6e7d Reviewed-on: https://boringssl-review.googlesource.com/23065 Reviewed-by: Adam Langley <agl@google.com>		2017-11-20 16:18:30 +00:00
..
CMakeLists.txt
rsa_asn1.c	Remove the buggy RSA parser.	2017-10-24 17:39:46 +00:00
rsa_test.cc	Make BN_generate_dsa_nonce internally constant-time.	2017-11-20 16:18:30 +00:00