Remove potential timing leak in ecdsa_sign()
diff --git a/include/polarssl/ecp.h b/include/polarssl/ecp.h
index 61d6a1d..1cafc46 100644
--- a/include/polarssl/ecp.h
+++ b/include/polarssl/ecp.h
@@ -118,6 +118,9 @@
* short weierstrass, this subgroup is actually the whole curve, and its
* cardinal is denoted by N.
*
+ * In the case of Short Weierstrass curves, our code requires that N is an odd
+ * prime. (Use odd in ecp_mul() and prime in ecdsa_sign() for blinding.)
+ *
* In the case of Montgomery curves, we don't store A but (A + 2) / 4 which is
* the quantity actualy used in the formulas. Also, nbits is not the size of N
* but the required size for private keys.