tree 1d1910566ed4c7ea8d447a42564cad9947504ec8
parent d654171087562744b7a0807741bd3fe752ea5f89
author Aurelien Jarno <aurelien@aurel32.net> 1652613845 +0200
committer Dave Rodgman <dave.rodgman@arm.com> 1666868295 +0100

Fix a timing leak in ecp_mul_mxz()

The bit length of m is leaked through through timing in ecp_mul_mxz().
Initially found by Manuel Pégourié-Gonnard on ecp_mul_edxyz(), which has
been inspired from ecp_mul_mxz(), during initial review of the EdDSA PR.
See: https://github.com/Mbed-TLS/mbedtls/pull/3245#discussion_r490827996

Fix that by using grp->nbits + 1 instead, which anyway is very close to
the length of m, which means there is no significant performance impact.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>