Add another round in the Koblitz reduction
The addition can result in an overflow so another round is needed
in the reduction.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
diff --git a/library/ecp_curves.c b/library/ecp_curves.c
index db35e96..47f1b34 100644
--- a/library/ecp_curves.c
+++ b/library/ecp_curves.c
@@ -5571,7 +5571,7 @@
mask = ((mbedtls_mpi_uint) 1 << shift) - 1;
}
- for (size_t pass = 0; pass < 2; pass++) {
+ for (size_t pass = 0; pass < 3; pass++) {
/* Copy A1 */
memcpy(A1, X + P_limbs - adjust, P_limbs * ciL);